0b136ebad5e9be01570aecd0c92906371c20729e09de4e7b2e3994be829d771d

Analysis

max time kernel
35s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

disk-drill-win.exe
Size

18.6MB
MD5

7dd843c7524d9d7b0cbce1ca2de894bb
SHA1

f84e6c5e6dfe61744376cbb8f465a9529e3e1543
SHA256

0b136ebad5e9be01570aecd0c92906371c20729e09de4e7b2e3994be829d771d
SHA512

d9dc3f58dfd3b5c711cadc9c0c4619c684cec00d66292aa404186cab7c8a958c8e345abf69be25ae4db6cd9688e92c42df5a0d614a461a7873010d24b84dcace
SSDEEP

393216:EtZSoFIFfYIyffUsoPA/ib9gPP/5XcJtH3vNuuftlh:EIFfnOcsoPA+qWH/Nuezh

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4168	disk-drill-win.exe

Loads dropped DLL 1 IoCs

pid	Process
4168	disk-drill-win.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	disk-drill-win.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4168	1440	disk-drill-win.exe	86
PID 1440 wrote to memory of 4168	1440	disk-drill-win.exe	86
PID 1440 wrote to memory of 4168	1440	disk-drill-win.exe	86

C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\Temp\{7CDAE6A6-59FF-41BE-B832-0CD7EF9F2D68}\.cr\disk-drill-win.exe
  "C:\Windows\Temp\{7CDAE6A6-59FF-41BE-B832-0CD7EF9F2D68}\.cr\disk-drill-win.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{57C6ECD5-85CE-4141-8997-D40FECD64E4B}\.ba\logo.png

Filesize
55KB

MD5
45a241ae6f9efb59c7506d5a5bd0ed32

SHA1
2a215973d58a9c465765a7885c302453cb240887

SHA256
23e6ebe4a24a22c55bef84892e42f1cad2873bb9706369056972387df4a72147

SHA512
92435d454035d0efc8c0f29c4ffb1fc137a4f9c80d78628bb0fe4ba94559e0f2eb3f05a8cc33c303d6eb3d88d67b93bfb146fd1c0ba02b07a4ebddb5e895a65d

Download Submit
C:\Windows\Temp\{57C6ECD5-85CE-4141-8997-D40FECD64E4B}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
C:\Windows\Temp\{7CDAE6A6-59FF-41BE-B832-0CD7EF9F2D68}\.cr\disk-drill-win.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit
C:\Windows\Temp\{7CDAE6A6-59FF-41BE-B832-0CD7EF9F2D68}\.cr\disk-drill-win.exe

Filesize
809KB

MD5
2d8db4992c8a75355a0b2ff46d356a35

SHA1
d18e8e2942bb6e6130a37de4571c875a3083c966

SHA256
df5c762325a6b9d7b933408c52c545eeb447f91034db6cb9e7813a47f5df5ed3

SHA512
6947c36b6b0f6488b260508d98d51c7229abca65047bba3f9455df10ad6d8a8b6f05dc57dde82439a0b528963a0ccd4f122c7d9fee84bff0f13503d074361cec

Download Submit