403b4fe478f7ba224e735bf1cf958d022bc6977ec8d36536848bd54f2ae460a7

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
recoil-studio-main/backend/app/__init__.py
Size 19B
Sample261027-d2tpsa1tg1
SHA256 403b4fe478f7ba224e735bf1cf958d022bc6977ec8d36536848bd54f2ae460a7
MD5 610e5f45c9371bc1e97e76ad9d156060
SHA1 50824d2d1a8430a29e12f9f2c0e20355d9b73f8d
SHA512 e68ac80bd17b505bffb6853018b82a8c3a8b26734630b6016abeabe0ae5792e2cdea0f89addb572ba63a9a5b07745b41eb7f6d423c54e8e55db56c846539816b
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3776	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5880	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\recoil-studio-main\backend\app\__init__.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:3776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads