cdde8b0993991f658a99354ecf142723b357ce54f084aefd42c843000a0346b4

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chronos-Nuker-main/src/utils/__pycache__/hypesquadChanger.cpython-310.pyc
Size 708B
Sample260824-we853aed54
SHA256 cdde8b0993991f658a99354ecf142723b357ce54f084aefd42c843000a0346b4
MD5 664b5cf2b6d621c66d26e7e107435631
SHA1 0e6ebead7c77b1d7e867236381c24e7d79f03adc
SHA512 a7df541e2c60584024be5f4d2ac9d740016125caad770b43754ead8c66257f4e8bcaab8c8b6d7630591967079dfbb6279e8dc497cac34ef01957b648b37bc806
TLSH
T12D01FE92D9015C30E6797230E78007341EFE31FBD81D2457266C4047085ADAEC26A70A
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6404	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3652	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chronos-Nuker-main\src\utils\__pycache__\hypesquadChanger.cpython-310.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:6404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3652-0-0x000001791B2A0000-0x000001791B4FF000-memory.dmp

Download