a397280a6b4e1a9c29462d2c6cde5eeac0d5d2b2c38a1b8399f6469f69a284e5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
script.module.jetextractors/lib/jetextractors/disabled/NEED_FIX/buffstreams.py
Size 2KB
Sample260910-akyevsec53
SHA256 a397280a6b4e1a9c29462d2c6cde5eeac0d5d2b2c38a1b8399f6469f69a284e5
MD5 f4e3b6b2a61c28d8b0167d8412e5dfed
SHA1 080443ebc22fb9a6fa0a167cd11f2a048cb7c5b7
SHA512 f539171931df54563cd89589a46e9a870a1020967afc861affeb44b97eec14f2352165e45c2cf204ded16ce2a9ab89e3feb136716fa75ea6269c15f44c7c2a4a
TLSH
T159412382982B711BC277447938552643F3161D23180A65247CFCD2BCAF795B3D7E0E9D
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\script.module.jetextractors\lib\jetextractors\disabled\NEED_FIX\buffstreams.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads