408b2faa52b5eb2ed5fe38c74bc70a3b74c9835f6bef937916dcc2ef89aba47b

Resubmissions

10/09/2026, 02:17

260910-cq7ltscq2x8

10/09/2026, 02:14

260910-cphlbawtey3

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Code_Forge_Phase2/cf/search.py
Size 1KB
Sample260910-cphlbawtey
SHA256 408b2faa52b5eb2ed5fe38c74bc70a3b74c9835f6bef937916dcc2ef89aba47b
MD5 54f724b5485125b431326ebe6945b435
SHA1 258ba756f243ea334e6df0e7c5faf271e6a39402
SHA512 373d42d6a10ff77f15c85ed552dc6d314ddb8aca7a03b9e2b9496bdcf4145f7515dcce246d5a2052843cb3516d9adb3fa5bdeb1fab1de17e4816b53342cac210
TLSH
T19A311105147731B381BCCA5C8DE1D8DD6258AD1330C01B2970FCEB8C7FA4E2AD5E9A49
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4248	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1852	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Code_Forge_Phase2\cf\search.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads