71adcdacf4368e3b2544593b4e5e587a1977db4d204b4092b70db8106ee83a61

Resubmissions

13/08/2026, 08:07

260813-j1a4yavdnf3

13/08/2026, 03:39

260813-d7mhnayzgz8

Analysis

max time kernel
72s
max time network
72s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fake_server.pyc
Size 22KB
Sample260813-j1a4yavdnf
SHA256 71adcdacf4368e3b2544593b4e5e587a1977db4d204b4092b70db8106ee83a61
MD5 9ae8da295d86f1909ddb2e12d23b6433
SHA1 6cb3604c6727465982fdc2f04ed4dbe5ff88c79b
SHA512 678eeb58313b048f63eb781dc11d0c504421d6c58fd2eb5938e95474775cd70be83e5f8433cae57e9741d44ba831ec841a3262e1313b6ddfe0024270f094c1dc
SSDEEP 384:n2RjK0Fg7vi8h9j1+BdwUmYHFMVuKiSEa7D3n:2RFQLh9jsB+oHFmP
TLSH
T176B2F7F86AE05813FEE4F93871F3E985BB32D1566809C757F224087E6D8A704AE9160D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2560	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2780	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\fake_server.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads