523010d6b1e7f3e0fdda379b7881fa9ec394cfc4e8b44e33563e0e7802ff68f2

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
checkERB_withReport_downloadfile.pyc
Size 21KB
Sample261027-qq67ysdf69
SHA256 523010d6b1e7f3e0fdda379b7881fa9ec394cfc4e8b44e33563e0e7802ff68f2
MD5 3aaf47621983c1d3cfab771c171737da
SHA1 9eca099eddbc5286068dda5610651f3d7c9b6d6b
SHA512 504d1b39a9c512e51e2103570f24d7ad08b3968e5128a19c812de697366215f3ee2f003a6bc1a3b0029749d9567864dd05c3944c7a8b4e8bafe1dacb046435d8
SSDEEP 384:1x1OesifUNxuQdRIWeTdi3sU10N53Kj+NViZx1:1x1lTfcP6FU1i3Jqz1
TLSH
T17BA2E871869424DFE9CCF07AB4899D443F3283BEB7629307F1245D7DAEE4329925821E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2748	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\checkERB_withReport_downloadfile.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2428

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads