b010baf97cd5c6eaf9151edb39cd68ce589f8da77c85fcc08412bd278962f69b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
13/04/2026, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
w2.sh
Size 640B
Sample260413-zykhlabt4y
SHA256 b010baf97cd5c6eaf9151edb39cd68ce589f8da77c85fcc08412bd278962f69b
MD5 5004ca0c607c6a6b1d82dc4c82423085
SHA1 54f333902a7781bcd9e4b70f5874f59cbb007330
SHA512 b9c3005527b248e15d7d130050745a9d879f4e10e53583edb53afff388d90663490ed8e9b7c4fcad1cb39e6e3b2ae499a826e181cd7c9106d66ad9d78ec8abb7
TLSH
T14CF0C9CA55707EA68024CF14E1760DD0530981DAB0E2F7E9A9F6042F8E98721F91CF97
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\w2.sh
1⤵
- Modifies registry class
PID:5020

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2956-1-0x000001A2CF2E0000-0x000001A2CF33D000-memory.dmp

Download

memory/5020-0-0x000001A96B220000-0x000001A96B27D000-memory.dmp