99107a560738480717aea87d8e4818cba8cf2dd0a6c5c92a30d7fc3dce1f6b52

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lal/_lal_swig.py
Size 412B
Sample260805-w1vjsstcle
SHA256 99107a560738480717aea87d8e4818cba8cf2dd0a6c5c92a30d7fc3dce1f6b52
MD5 5995f15f07757920b872eca95d0357e3
SHA1 0659dba0cf2c2cc548c2ebb6c6ed75325419d396
SHA512 182fbc7a8eec00da3543cacc723e55758461d4086a7a6157c95399bf77e97e5ce07b57e674b667cd5ca1b4f41ce441c53a49f4f5783d6409d5f8c1720fb7f47d
TLSH
T13DE0AB6C1C92F3B3484365C4058A8177ABB3608D035043B111282BA173A03E40A988B8
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3884	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lal\_lal_swig.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads