f4d8129ae50107c51d8f449c1eed5aebf1fa92b9b99a151674d3ab95b4aec858 | Triage™

Login
Reports

Overview

overview

9

Static

static

3

pywsl.exe

windows10-ltsc_2021-x64

pywsl.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
pywsl.exe
Size 7.9MB
Sample260804-vnky6aea73
SHA256 f4d8129ae50107c51d8f449c1eed5aebf1fa92b9b99a151674d3ab95b4aec858
MD5 8671228c7e9599fac100eae95468e29a
SHA1 adbbaa71c9e36cf2531b92b5bf74dfd8fbfc61ec
SHA512 6aee39789957c7048b7d8caef9ad1c1e6cf55f5485aaef8877e0b069cd174e9cd7e2fbd692d34e050a8cb19a35de18ec9bd2e93fbaf987fee0743ffaa76edd03
SSDEEP 196608:dgR2eOqlXurHMuhHToAUPNfGU5vXvE4LFdIgZ+:WuqlXuJhHTodRGkXs4hJA
TLSH
T1AB86337662C408F8FEB7E53C89529225E7767C414721C5D703D48B62BE3B6F42E3A262
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution impact persistence pyinstaller ransomware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

pywsl.exe

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

19 signatures

150 seconds

defense_evasion discovery evasion execution impact persistence pyinstaller ransomware

Behavioral task

behavioral2

Sample

pywsl.exe

Resource

win11-20260513-en

windows11-21h2-x64

22 signatures

150 seconds

defense_evasion discovery evasion execution impact persistence pyinstaller ransomware

Malware Config

Targets

- Target
  pywsl.exe
- Size 7.9MB
- SHA256 f4d8129ae50107c51d8f449c1eed5aebf1fa92b9b99a151674d3ab95b4aec858
- MD5 8671228c7e9599fac100eae95468e29a
- SHA1 adbbaa71c9e36cf2531b92b5bf74dfd8fbfc61ec
- SHA512 6aee39789957c7048b7d8caef9ad1c1e6cf55f5485aaef8877e0b069cd174e9cd7e2fbd692d34e050a8cb19a35de18ec9bd2e93fbaf987fee0743ffaa76edd03
- SSDEEP 196608:dgR2eOqlXurHMuhHToAUPNfGU5vXvE4LFdIgZ+:WuqlXuJhHTodRGkXs4hJA
- TLSH
  T1AB86337662C408F8FEB7E53C89529225E7767C414721C5D703D48B62BE3B6F42E3A262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery evasion execution impact persistence pyinstaller ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Scheduled Task/Job

Scheduled Task

System Services

Service Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Direct Volume Access

Impair Defenses

Safe Mode Boot

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionimpactpersistencepyinstallerransomware

behavioral2

defense_evasiondiscoveryevasionexecutionimpactpersistencepyinstallerransomware

© 2018-2026

Terms | Privacy