e69cf943052ec117f70c91328e6cac912031b31e31c4f81d8db84249ee836533

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
neext-0.3.10/NEExT/collections/egonet_collection.py
Size 16KB
Sample260805-zzlr2swfpg
SHA256 e69cf943052ec117f70c91328e6cac912031b31e31c4f81d8db84249ee836533
MD5 44bbff32d6e9463c66f6a6df43cf7383
SHA1 7dc8d0e0cbaeaf7a20d41a3214da08299ca72fdd
SHA512 e51f20ab192a2c418907a924c171301bc0e90e1ffa185507a87d221f714e8242adb940bbcc42ba3a7b258939bc2d0c0ddeefcf9b7cac130d13ee8992853c2efe
SSDEEP 384:1gwZMiPTKXeGgIwuJKmHb5E98mHjJbaHq9m7jA:GkBTKuGjwmKmHljmHRqq94s
TLSH
T18E72843BE9725B2819E3897A24C6069532B4D4273C4316FCB5ACCA486FC243951FBEDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4156	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2372	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\neext-0.3.10\NEExT\collections\egonet_collection.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads