5f8c4ace31300aca326bd0dae707d88f93cc2b478b3ca2117dd3b313bc4dff16

Analysis

max time kernel
148s
max time network
50s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaaaa.py
Size 23KB
Sample260815-nxnyvabk21
SHA256 5f8c4ace31300aca326bd0dae707d88f93cc2b478b3ca2117dd3b313bc4dff16
MD5 549f4fbb924407d276ddc25d5dbee93b
SHA1 ab17375c5429d67f76e1c0cf49bbeef992da7207
SHA512 fca83879a521aab1b229619d25620d9b64839e3eda9ff82ff8d1392c7b20c42394ab21f4def2e8f72cf511ee8a716acf4a38e32d032486e3ab2a2543658e10be
SSDEEP 384:t4Lh9vcTYKgP7OrEgQy0q0PIYyMGuMK5OEsi8OGKjdqvNsYCGejer/pGjHVUY:teh9vCYla1v0PIzsONOGenjt
TLSH
T1BDB25312E4057E8DE387DD394457A607262A2C27584E6D3CB8BCE1884F6C23659F8EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3012	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3468	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\aaaaa.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads