26b7450998b5e04410a77486c695457c58dcbc8db24f50cc685651d223f3be8e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
python312x86/Crypto/Cipher/_EKSBlowfish.py
Size 5KB
Sample260826-mbkhvstvhs
SHA256 26b7450998b5e04410a77486c695457c58dcbc8db24f50cc685651d223f3be8e
MD5 a5f07807c63a0a82cfe7f644d72c9f9d
SHA1 4f44ed26fd9770a9b8ed279c9e75ffeb2c84b756
SHA512 535fdcfdddf7d64d097b0b51f64ebd14d453895b167e379d105e15f8f9681100b324a02004a3dd059b599ef88c01b81e0ad5546e90f1251ea2172ba5df6d9252
SSDEEP 96:MHDqrYJALrYJHdt3EHGuITiwnHav1ZaVDYyOKgiaiJrJtk3I99m2Ht3HRF29:0qrskrs9t3q/ITHSVNi1bk3ITm6tXRY9
TLSH
T1D2B1B8030D42CBC22776554A3D3EB888E32532273B619A1339BD925C6F37739E55A298
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3512	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\python312x86\Crypto\Cipher\_EKSBlowfish.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads