183ca139be250d9eedb211fcbcab1244b3ba88488c1db121d56251acc1737f8e

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libs/Crypto/Hash/__pycache__/HMAC.cpython-314.pyc
Size 7KB
Sample260809-adbmhser5s
SHA256 183ca139be250d9eedb211fcbcab1244b3ba88488c1db121d56251acc1737f8e
MD5 73784e1f17b09344e51d693ed0a32d51
SHA1 522a26983cd95bab4dae01a32c7735da4db870a8
SHA512 830ec099ac77b03bc6a107e17361248b4c5b6e3f9eca62b75e7b6be51330abd1acec3cca61f1e76fbb5051d6ae92fb265109f69b6c41c079a6377147f5e61c17
SSDEEP 96:cIOv7wuvsl5iMUG/8YRDaIZUCmZGp/MAIsOdhiIyq42MHxuTlykFqkBWD0PBXSM6:cNwrJ3ZmIICIsg0IyqQRuJyypB+sydB
TLSH
T145F1E7756294CA73DDD791FDB16BE049A702B0220399AB13F59C58DA8F18C94E93029A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1080	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\libs\Crypto\Hash\__pycache__\HMAC.cpython-314.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1080

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads