4aba829c8d716fcafd8459ec9e37c791e48c0e0c2880e5d1eb06061ec792d48e

Resubmissions

02/11/2026, 15:19

261102-sqlblaxs6j10

02/11/2026, 14:52

261102-r85yaaay4y10

02/11/2026, 14:22

261102-rplqaswz6m10

Analysis

max time kernel
149s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lib/python3.14/site-packages/cryptography/hazmat/bindings/openssl/__pycache__/_conditional.cpython-314.opt-1.pyc
Size 8KB
Sample261102-sqlblaxs6j
SHA256 4aba829c8d716fcafd8459ec9e37c791e48c0e0c2880e5d1eb06061ec792d48e
MD5 28f250467bde082e44c0a6473daea2c6
SHA1 dffa48eb47df062057a87ab0f5db30189314a09a
SHA512 6f5ba50512d7e1cc976d3b6b40196ab0a5e9c741be0094ec92fcb27b773512ac82c6e8d6b76496f24506890e4fcd92d55ebd83a14b248aa1c4d7a1f323325bea
SSDEEP 192:vUaMgqaOHQLcMgqLsMgq8MgquwMgq9MgqaIMgq6MgqqMgqo8MgqRfMgq7mT7kMgh:8iqucqYq8quAqJqaYqCqyqrqlqZqvNqB
TLSH
T18D0242C93FD86A15FBE5F97428F3C31A5B03C52A654A13777B31008F78FA644CAA4916
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python3.14\site-packages\cryptography\hazmat\bindings\openssl\__pycache__\_conditional.cpython-314.opt-1.pyc
1⤵
- Executes a command shell one-liner
- Modifies registry class
PID:4660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads