e7558df1f58906078be1d81c5250bf92e8cfb65bbfa5750212e6518e0b1f2484

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chatuidemo.py
Size 552B
Sample260930-fxnn3szbpd
SHA256 e7558df1f58906078be1d81c5250bf92e8cfb65bbfa5750212e6518e0b1f2484
MD5 c7df5d53ca13d7076dde243ff1307763
SHA1 e7e4d4eef0767c3c2f05bdbdaf6a0cc9e9dffe2f
SHA512 861d442898f0b36e1569c68bc13be6ff4bfb0aea7fbe4b9868963e0d9261285ef118cb2f69edeb4c1e7cd27ce3fa76615273912450ab3d313a9f9223ba262637
TLSH
T168F02B0658BD085B893E0C65760E63610B12294F0ABAB433B1BCE3706B65153C582BDD
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4960	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2508	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\chatuidemo.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4960

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads