84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/04/2026, 17:22

Target
cat.sh
Size 1KB
Sample260407-vxtbwsat4q
SHA256 84ae7b478909fe9c3a0ebb340ab8b54399c978eba1ee503b67965cba2b08c23d
MD5 57775f162f28e4727c36503b038d48be
SHA1 d7317c63d7cb99ed36d3c0f36a935048a29a844b
SHA512 5782a47b95d547ab90e0845cc30f5bbd3500e545cf9a267e163a2c9660a0dc00ec820a1d72a8a715c5764738512b593addfa488b7833005caf09fdba99c082ac
TLSH
T1DF210ED90152A283C67BDD1C7A75C9446222E0C3A5CB2E3EDCD418ADCCCA76AB215BC9
MD5 SHA1 SHA512 TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4344	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cat.sh
1⤵
- Modifies registry class
PID:4492

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact