92d0812520d2a7bdbc05e24105e47fc4ef59984986d70ac4e1d28e94a4bf90dd

Resubmissions

02/11/2026, 12:34

261102-pr5vvacs6q7

02/11/2026, 12:30

261102-ppg11afb396

02/11/2026, 12:02

261102-n7lw8sszgt8

Analysis

max time kernel
898s
max time network
421s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hotel-dusk-decomp-main/tools/build.py
Size 2KB
Sample261102-ppg11afb39
SHA256 92d0812520d2a7bdbc05e24105e47fc4ef59984986d70ac4e1d28e94a4bf90dd
MD5 31e8f4fec75b53687ede9998d1e3fbf9
SHA1 fb11d2843c3a4044d0b1445f081bc3651b37d208
SHA512 84c9537c782f3ec63d8b275399e48076666ad1c1ca029281cd4cf8c34512934b32dded3837bf04ef6cd4014b7090167deda44f5c71b0cbc85f9626d9dc909d0b
TLSH
T18741AB0B19D6A42452D3C38CBE515AC08A3F4DB79B8FB816B5DE09D8DFA93D0857D82C
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3202520547-175870679-441661622-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4980	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\hotel-dusk-decomp-main\tools\build.py
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads