b88b44dfcc911afa844722a2593387b53e1ae65fe6ec18a93d2d422855e3ab03

Resubmissions

03/10/2026, 22:31

261003-2fqm1aybpb

03/10/2026, 22:30

261003-2e69cszwct7

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Emulator.pyc
Size 8KB
Sample261003-2e69cszwct
SHA256 b88b44dfcc911afa844722a2593387b53e1ae65fe6ec18a93d2d422855e3ab03
MD5 06b2113e57a3d9171d1aeac4c8f1d60d
SHA1 917804ef18d4d921f881dc192c0566269dc884bd
SHA512 8cb0be08e2a064aa6dde1e2a5a8b3a113d7df3e783538dd1084e538e1495499f80441a4ffac778832d94150a26f28741dfd191e35fa34a82a50bdb70d81342fb
SSDEEP 192:CFYM6O9wGBP2dKiNM++UX6q0tfPGrfl3kYRS3wik73KCP1W8J:Cuw9w22dKiy++UKBsN3VUgik73KCt9J
TLSH
T141020782B59B82B9FC85F372A0772F686B5042D0B5D28748FEE65CD00CA37708EA515B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5068	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1036	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Emulator.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:5068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads