005a2539aab18593e0e489faa647ac2d6574fc4759040e86a7d3753b6a0c504b

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_python_20261002_e94628.py
Size 1KB
Sample261102-gr329afs3w
SHA256 005a2539aab18593e0e489faa647ac2d6574fc4759040e86a7d3753b6a0c504b
MD5 d568e10708fcc7805f2ec330547ccfe7
SHA1 e94628479bf3f24fd8f2e70b786ac2f9ed99c6d5
SHA512 dec65856ed80ebb78ddc7b51e1a3efde90c3ff22eccd8ae971f6f96081697f9aac393510b5dd804dc5a77ccad39d99db497ce1d14dfd3c4680fbcef6fd34a908
TLSH
T19131D1A31D460523AB45CA0A45F7312DF6F1E823AA57FF5200040E28FB2B9B3A218732
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5240	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\deepseek_python_20261002_e94628.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:2420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads