Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/02/2026, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed.sh
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed.sh
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed.sh
- Size 11KB
- Sample260222-s93d8aet4d
- SHA256 81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed
- MD5 2cd377a5218fb880fa479bc86f0f368d
- SHA1 7df029c3f456dc2515a74fd8263ac6c89c86a0c0
- SHA512 2ab69c8dc5c4e7d123eab0b8a912c304df1f4bbb7a52ba246a779bb2366f671569166fe05437315ba89649383cde11a4058679ff4700fe25100e4a3365121a0d
- SSDEEP 96:cLuKB63uxu+SEgI45+fIBVIB7IBMIB8IBrO9F7S+vevGvNSJCqArXy5vR:cLuu6Yvk0ewPzi9
- TLSH T17732D77435F14C333A616940B3772BA2ABB7D95345A3218C39DE2E265F87B12B4BF811
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\81fc53a74d746478aa8c15f56a85f3e51158a0849bf0f64f2b9c6aff90f99aed.sh1⤵
- Modifies registry class
PID:4924
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3916