b625765ce751d3a56674fee9215ba69777a3e7ab37e6cbcf418c918de423c0a3

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2023 22:02

Target

base_fragment.sh
Size

161B
MD5

5b293a8112b38e1222fd981265e12dd3
SHA1

a888f14ac2b39c90b68f194e3a69e0754f1a78fc
SHA256

0980057dba7e8a8d76f5137a5c69a6e9b08f8903cfb2c2921c603b9f1233c544
SHA512

606e6aa3bac1e39548e84d8f11f8e4ce23106ef0044b5f358f30b4f2a5b49ad5805464b804dfd19bfa34b37b76d1d5a8dd4223bab483cf5e9e953d387e69a4ec

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4078585466-1563564224-3678410669-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5016	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\base_fragment.sh
1⤵
- Modifies registry class
PID:392

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact