d35d02cba96bd5cb9ef8e1eaa50a86eeb9e00cb5e345309471e8c28251efc125

Analysis

max time kernel
151s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 22:00

Target

mask_frag.sh
Size

387B
MD5

9f1d977cabaef58dd9ace5a85c411d45
SHA1

fdc57f80881b492e305c48505c245a3211705530
SHA256

5331f0612a6c774a0c50de339f78fadb604711c60109906a0d44a6ecaa5c2dc8
SHA512

8ba72c46904b99f5dbc4ba33bc17a94c190d8f3fb2feb18a9d96042abf7eb2cfb6006254996ae313ae41d180cdc8a7b9860959de22a4f7ed9f780ab28c44b4bc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4532	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mask_frag.sh
1⤵
- Modifies registry class
PID:3540

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact