675c3f88fa7a967539a883025f1de786ebfe5cbe4d6f24d4b8516fc06eabc660

Analysis

max time kernel
99s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
16/08/2025, 07:51

Target
r.sh
Size 923B
Sample250816-jp2shswtbz
SHA256 675c3f88fa7a967539a883025f1de786ebfe5cbe4d6f24d4b8516fc06eabc660
MD5 f4901d9748924defb805672e09cfa726
SHA1 46aa9471e4d0f911d525051df8ef9caff7481c2b
SHA512 e465f695e32c7a3bd3ae78c8c02394f3da8fd09ade652af2b9e0ea9709967ecd624a6e6cc4cc3d1a49e6ec85e07b3003c2107b77fabc07eb73b38750ed15857e
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2340264150-4060318110-2688614100-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4744	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\r.sh
1⤵
- Modifies registry class
PID:944

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact