fafdf19c6746f478267898ec911dc0d219fa6c38ca1efc4ba56e053f6cde22ef

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
scripts/maya_umbrella/__pycache__/cleaner.cpython-312.pyc
Size 8KB
Sample261102-p189matwfx
SHA256 fafdf19c6746f478267898ec911dc0d219fa6c38ca1efc4ba56e053f6cde22ef
MD5 41bf04fef41c635ef7a368fbb53ef58b
SHA1 585337f4c4900cc8ba23a0582f034ec76eb75f3e
SHA512 597e16ab6cbf1f5714a6751aa02ae8161869cabf4adf688bc11c3fad138d72c672021036f234ac23503dc0e4b2c284f7f07fdf544f1ffc0dc859e09330eef85e
SSDEEP 192:x+6jEw+k5VyYb9gUrozj+dKsZtXtomq9N:xPYjk5IoMjfsZ1Bq9N
TLSH
T1770294491B63C833EEE8F2B480663B89F667C564BA05970731FF91092E87260DE641CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
928	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2536	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts\maya_umbrella\__pycache__\cleaner.cpython-312.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads