Analysis
-
max time kernel
211s -
max time network
234s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 13:22
Static task
static1
Behavioral task
behavioral1
Sample
bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe
Resource
win10v2004-20221111-en
General
-
Target
bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe
-
Size
5.9MB
-
MD5
3bcc23762fb76b0dfc65a314b63b121c
-
SHA1
ee4ee7932691335979c143fe52f53f313bf98061
-
SHA256
bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1
-
SHA512
ca2c151b3a3626f17152e1c03e03c0d6ef3a1bb01d440abfe32ff2a949096f19beded0f6e5913a99b0d0f68b51cc507a425119ca8d2e6ed058f289226a55c3bc
-
SSDEEP
49152:4aMeLAdcuEf5Izt7Fyczouk1JUVbCZhtv7a+XpycXMDaUfFXjshOR/eSyd:4avAdyf5Ct76abmtvZS+zhIe
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\Q: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\S: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\V: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\E: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\H: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\J: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\K: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\L: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\P: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\Y: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\A: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\F: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\G: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\I: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\W: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\X: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\B: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\R: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\T: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\U: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\M: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\N: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe File opened (read-only) \??\Z: bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4376 bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe 4376 bb77e158b7f62a9e1650e2b0ddfc782162722ae68800ec44643cf7a6c7caaff1.exe