Analysis
-
max time kernel
167s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 16:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe
-
Size
3.8MB
-
MD5
80dc10588be6dc22c07002424594c62d
-
SHA1
a85ea0f59b2b552258cfb54ae37acd0f71ee5275
-
SHA256
21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e
-
SHA512
a910e439611029aee1bf7898bf3a391000673edab59a581f3670bab47d291ea8425ae8f10ca09e22d9e966875518f92a74c8c10b5e0318fbce853b20b840cce0
-
SSDEEP
49152:jTA9++SsHPvHV8YTpFIChtcLphFcWgJ3sv54PONhx7jZd4AFmT:jyHlDGLaA
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\J: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\K: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\M: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\N: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\V: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\X: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\E: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\L: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\O: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\T: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\W: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\Y: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\B: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\G: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\H: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\Q: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\S: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\Z: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\P: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\R: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe File opened (read-only) \??\U: 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1356 21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe"C:\Users\Admin\AppData\Local\Temp\21f32debcc0dea70fbe2a6b5d0516b1922558c1a71f3bf994519a10bef0ae27e.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1356