4a9f863bc2b653a78885958f4062b42b1989e045728cac836374efacc066d09b

Analysis

Target

3f6120ca0ff7cf6389ce392d4018a5e40b131a083b071187bf54c900e2edad26.sh
Size

217B
MD5

cf2ce888781958e929be430de173a0f8
SHA1

e851126ef41e3dc474238d3160f4b0e7e3bbb7ec
SHA256

3f6120ca0ff7cf6389ce392d4018a5e40b131a083b071187bf54c900e2edad26
SHA512

c39f20b6c554ce1720fdfff46b3b8fdd743f82fb0598d49589b6bddc6a806ca82c4e7ca58926d590c6890a00c7e379f98bb139e7023eaeec8cbf5548d4db3a49

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3216	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3f6120ca0ff7cf6389ce392d4018a5e40b131a083b071187bf54c900e2edad26.sh
1⤵
- Modifies registry class
PID:2424

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact