Overview

overview

6

Static

static

1

Client Com...ent.py

windows11-ltsc_2024-x64

6

Client Com...up.bat

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 14:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Client Communication/Client.py
  • Size 2KB
  • Sample260816-rydfaaz1ct
  • SHA256 fea1a57b509e1be7e1062bd6441dcfa73e2cf06e21c8fc2b1cccd0d7d6476057
  • MD5 SHA1 SHA512 TLSH
Score
6/10
discoveryexecution

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Client Communication\Client.py"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    PID:4484
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play "C:\Users\Admin\AppData\Local\Temp\Client Communication\Client.py"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\unregmp2.exe
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1692
        • C:\Windows\system32\unregmp2.exe
          "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
          4⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:5420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1196
        3⤵
        • Program crash
        PID:2000
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
    1⤵
    • Drops file in Windows directory
    PID:2016
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 400 -ip 400
    1⤵
      PID:3416
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:6000

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            CurrentDatabase_400.wmdb
            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
            • Size 512KB
            • SHA256 7946b1b863ec8e4506bdbfa080366fb69042f410a16560daba1e77c975c7636b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CurrentDatabase_400.wmdb
            • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
            • Size 1024KB
            • SHA256 d6ca3a6b394e905228782810dc6111f7cfd483e93f724b3d33f367c798b54b98
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WMSDKNS.XML.bak
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
            • Size 9KB
            • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmsetup.log
            • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
            • Size 1KB
            • SHA256 05395c8f0364e4a83beea11899c7b8278bed95d4975ada250cc8fdc8bdae2a45
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/400-32-0x00000000088D0000-0x00000000088E0000-memory.dmp
            Download

            memory/2552-0-0x0000016C33970000-0x0000016C33BCF000-memory.dmp
            Download