fd2f99c602d5535e2994dd1bbd1955a8baf2b417f99b86584a7c608703297f2d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update/SysMon.py
Size 144KB
Sample261006-e41fsa1v5r
SHA256 fd2f99c602d5535e2994dd1bbd1955a8baf2b417f99b86584a7c608703297f2d
MD5 f2eff792f3ccb3721f3f387670c748a1
SHA1 d384ef3f9cd0dc88e273c54023f5fc50fdd6cba1
SHA512 23742baaf8c73f2851ee4030f28c5e61fa09ed23c73dec36a53e7dbebd43b53f2408b6cce2d4996deb47ef69686fd84ff20b1cd88e0ad7e1b39af0e389858e0e
SSDEEP 3072:jtO9r4ptLTwAmEGSZ3vWjosZA+D6TSygIUpE041rRqWGLunKPe1sNWDEi0ucCHWH:UOpmzEZZf0xHHyg5grRqRLl+sNnHH
TLSH
T1E5E397855622E17E5B97CE192F43AECC2869D9EFC5C9E701F0841A4FE0A873C94E57C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3068	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Update\SysMon.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads