Analysis
- user interaction
yes - max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 18:31
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
explorer.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
explorer.pyc
Resource
win11-20260911-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target explorer.pyc
- Size 2KB
- Sample261014-w55kkahs21
- SHA256 27637abf52ac934bcffb137f59e5c1d41f2aac230d7c7e224b32352ab6ffcceb
- MD5 bb0c2dd8e6c3ce7dc8034551b9bd30b9
- SHA1 e7c6ed4063d6959ac11e16434deb0e815503167d
- SHA512 46cfca3d0bc3316bb53ab7915bd199b00d092c6a1cea27e9a34c679e50b7d619fe395d079f9d7b40a0bc6942c44277dad400adb76c184f71575e18521f6cd926
- TLSH T1184194AA954C72A7FC5CFD3C6097580917E141B7F995C0D36A48B08E0CB818449642AF
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4388 cmd.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\edit\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.pyc OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\pyc_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.pyc\ = "pyc_auto_file" OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2192 NOTEPAD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2636 OpenWith.exe - Suspicious use of SetWindowsHookEx 45 IoCs
pid Process 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe 2636 OpenWith.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2192 2636 OpenWith.exe 114
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\explorer.pyc1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4388
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\explorer.pyc2⤵
- Opens file in notepad (likely ransom note)
PID:2192
-