1c564ba8fd317c2dc23919626c6a2d4c6d95f3460b385ef06412cd52ea86f73b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libs/Crypto/Hash/__pycache__/KMAC128.cpython-314.pyc
Size 6KB
Sample260809-adbmhser5s
SHA256 1c564ba8fd317c2dc23919626c6a2d4c6d95f3460b385ef06412cd52ea86f73b
MD5 8dc70a75c36ad9a2fc0a5e2fa25c56bf
SHA1 aff3d749179dc9b5ea70a296c27e1e6830580df3
SHA512 ee055312073901d3e463d7af10c867f526d6c2ab70bb2ab804f8add4e8fd75c730a1aedaa435ed76d61bbd65738529c392f07dfae67f50061205d2ba3a1eacb3
SSDEEP 96:pY+shcH4Y+Z2ls1N2M4B9d9APEFqXGwaMtwzp0M1AUn:RHxlo54J9eS6G3Mtwzp1xn
TLSH
T197D1A818AB449B3BF9E7F0B971AA61496712E4231105A213F1BC48E54F98CA4DE713AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1984	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5148	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\libs\Crypto\Hash\__pycache__\KMAC128.cpython-314.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:1984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads