e3dafcf7fed956e0be2c0eb584c8c17bc6cf9333bd6b1e0dc6ba90dd9d4bea97

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libs/Crypto/PublicKey/ECC.pyi
Size 2KB
Sample260809-adbmhser5s
SHA256 e3dafcf7fed956e0be2c0eb584c8c17bc6cf9333bd6b1e0dc6ba90dd9d4bea97
MD5 b136e1d8f495c8b123bf59be5fa623b1
SHA1 c2f689ade3cf34d25fd9c2382e8ed1c41cb5eb7c
SHA512 11045ed2e0a095597bcce6adc77bee0d538ea5ca72d3a0b13509a21536dd29b7ab9d3e55dceca086d1fbae7d218a9878c595f72f7436634b2785bde0283be47c
TLSH
T10251E0064657E6D521F986B259691831CF3947C36F5421C336BCA37C4FBB929CD7086C
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6124	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\libs\Crypto\PublicKey\ECC.pyi
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:6124

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads