4d10378675eb57e00df605a9e149d6ce16fb7b315c561c8a9e411dde75c27971

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:37

Target
4d10378675eb57e00df605a9e149d6ce16fb7b315c561c8a9e411dde75c27971.sh
Size 21KB
Sample260715-ptqtpscw2r
SHA256 4d10378675eb57e00df605a9e149d6ce16fb7b315c561c8a9e411dde75c27971
MD5 a4c2129534d81f97cab0e75878a69295
SHA1 56667bdd37afa6d5becb62461b9f3c628aba25f8
SHA512 655ca7724b1ba8ab60e16969f35d168261e6aef4b4e6a948897086289f8e8696e17876e3c78b2f4bcc8da95ced0d6cf2f0bc756ea9251e085a93b711ef3881e2
SSDEEP 192:c5uv6L4hvZ5mN9oKNpivjFV3+gukIFzITh5oeyeVeO:+L4hvZ5mN9oKNpivjF9+gukIFzITAXGL
TLSH
T193A27D7620F08A735A9015C4B37317A15FB2955745A320B8B4FE2B399F69B03B4FF621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4d10378675eb57e00df605a9e149d6ce16fb7b315c561c8a9e411dde75c27971.sh
1⤵
- Modifies registry class
PID:2808

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact