0499cace47a1682bbe584267dc6e0be8b35020f070cc82795062ff000fdcc80a

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoyalRenderings_Playlist_Manager.pyc
Size 98KB
Sample260808-wbcyfs1hnd
SHA256 0499cace47a1682bbe584267dc6e0be8b35020f070cc82795062ff000fdcc80a
MD5 1f4ad3dc87fd90fcd6bbf483fc805c00
SHA1 ff61b5709688cae1c0b742092af4e6ce17635862
SHA512 b46e55c19269ad7ba8109097240f71d7cb80a70a7497c5063f49a928c50e77e23f17c015e1637724615ddb244e44b6bf0cb3010e8bed1ae119c69be627dbcea7
SSDEEP 1536:nZ7MvqWKGgWVU0R0FGTK4tC69zAAmcxyws:Z7MvREm0gTltkKm
TLSH
T11EA3E5857B72C4BBFCA1F1B61459231AB760E5A17740D71731BB8078AE4BAB49C620CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
928	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4828	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RoyalRenderings_Playlist_Manager.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads