Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 04:50
Behavioral task
behavioral1
Sample
GPO_Fishing_Macro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
GPO_Fishing_Macro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
main.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
main.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target main.pyc
- Size 4KB
- Sample260809-fgca4shm8t
- SHA256 2bceb6ad441b5eeae245be6f7f8b4f4aab65f008e6bc2a7c83195c109d7e427c
- MD5 895ae60a7524088d0ba936bd8864ed63
- SHA1 8bc7f2272001caae1b24cd219d84bd020ad7e2bb
- SHA512 38d5708f9e3e54313663f15de490f73038e99964d08931a15b7358ed55d2be94b8d87b2b22d283b9ee5db92bf32d71efa018808ecd73d037567e5d80fa3560c4
- SSDEEP 48:gXfv1vQ60yt9oxKPk6TAMDTkc+0CyfODKXDsx8VJ+18y9TfXa/ewKMFH0ENEis3I:ev1vQ8H/k68MTkc+0CmD7VJl/ewBUkx
- TLSH T19981A50ACA104961EBA8E53460EA4918D7FD6DE1B436835B774E01A1CDDB77ECF5930C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2184 cmd.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4908 OpenWith.exe - Suspicious use of SetWindowsHookEx 45 IoCs
pid Process 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe 4908 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2184
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4908