061372cecd8bd05545efc26231fbf14a3ded422f1f408b3110c24cf1fc58f94d

Analysis

max time kernel
43s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 05:08

Target

disk-drill-win.exe
Size

22.1MB
MD5

7009ef0bcb5abd5d94f22b0b2d64563f
SHA1

0b623230797d299f39949f6b5d188bcd655d3953
SHA256

061372cecd8bd05545efc26231fbf14a3ded422f1f408b3110c24cf1fc58f94d
SHA512

f0fdafffe647b5634c12b09e94f2d8d6fe99101c148cc0a9066824bbe9bba0d4b990efad29a0317aaad7f276d119ee0224e8e451e12a0a6aad9de73a3ee5cd71
SSDEEP

393216:xMawbUzY9XVcgZGBWVXcHiH/R6BBPJAhOI/rWB079LqsbEdGi+/InuR6o89:xwbUzY96gYBWGOGRJAkWa8qsX/e8nO

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

disk-drill-win.exe

pid process

1408 disk-drill-win.exe
Loads dropped DLL 1 IoCs

Processes:

disk-drill-win.exe

pid process

1408 disk-drill-win.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

disk-drill-win.exe

pid process

1408 disk-drill-win.exe

pid	process
1408	disk-drill-win.exe

pid	process
1408	disk-drill-win.exe

pid	process
1408	disk-drill-win.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

disk-drill-win.exe

description	pid	process	target process
PID 1896 wrote to memory of 1408	1896	disk-drill-win.exe	disk-drill-win.exe
PID 1896 wrote to memory of 1408	1896	disk-drill-win.exe	disk-drill-win.exe
PID 1896 wrote to memory of 1408	1896	disk-drill-win.exe	disk-drill-win.exe

C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1896

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{CF13D157-FB27-4410-934B-ACC8E91D1497}\.ba\logo.png
Filesize
80KB

MD5
bc348d03ed3d614eeb776df9c17dd0c9

SHA1
0d0628742f480a07e08f251d7ffa6d2c671b6811

SHA256
bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786

SHA512
12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311

Download Submit
C:\Windows\Temp\{CF13D157-FB27-4410-934B-ACC8E91D1497}\.ba\wixstdba.dll
Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
C:\Windows\Temp\{F706FCC8-3809-426A-A16B-E5C7ABDFCDCC}\.cr\disk-drill-win.exe
Filesize
888KB

MD5
ed8ef613120fd1c3094a48744c37580e

SHA1
86586f97bb0bd81fb8300a45d2de362cc71c699e

SHA256
5689a5c40b3b778165914ff22ca3dbf875d4cf5ab4b30390ad20387f86cf9d48

SHA512
e7d0b5b0fcae1317be05e251667556b14327bb4155b6ba0435c2413c655db4c766fe2585a195dbda5fa54477e4e523d97b16a59206a02b73ac77efdd8fb4f029

Download Submit