fdc0272f05077378de4c558ecb87de22998e82593d860c92683544517d6f2c79

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sys_buddy-2.3.0/src/sys_buddy/admin.py
Size 29KB
Sample260804-wvcf2abm81
SHA256 fdc0272f05077378de4c558ecb87de22998e82593d860c92683544517d6f2c79
MD5 047e0f95463e0b2ade28c035a29befe4
SHA1 fca30a5da8bf17a4326a333f168519df3e8f25df
SHA512 3863d2fc000d3733e9ef5bf7bf39dea013ab6f2b846036c22c8944ec98eae545b2eefd3b2b1a342f2e26e0571aa57d6b1f73e73e014cb72126106c3418b1c7a0
SSDEEP 768:Ea+RRfIqL7RKbqjMEP/Tssm2ZJo9x5xS6k:0rfIW7RKbqoezEA6k
TLSH
T194D2C517D3506B3157E306314D8BA1D68B25946F2E10296CBD4ED1BC2F496B8A2BF3DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1688	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
788	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\sys_buddy-2.3.0\src\sys_buddy\admin.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads