81251cbd72094f75056b05667727b5237922810be7750210678af5b4ca5aec83

Analysis

max time kernel
1473s
max time network
1487s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 06:23

Target

launch.sh
Size

72B
MD5

9c506d84b5408061ba3edc3c01590bd9
SHA1

b7882efe80a13794c0b21c9841ffaf83976fdaa2
SHA256

961a4c94751ccd8a656d1983c98a1c42c2a166b284e6a2b221e93fecd644307d
SHA512

c1129a7e11f47c736102d5d16bebfaf44af9a2955b88acda1e08162561baedb5e44f337b75e0405d831e5685816be59f5f73e5b4a92faa3f993424de9434285b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3708	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\launch.sh
1⤵
- Modifies registry class
PID:4576

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact