061372cecd8bd05545efc26231fbf14a3ded422f1f408b3110c24cf1fc58f94d

Analysis

max time kernel
192s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 14:51

Target

disk-drill-win.exe
Size

22.1MB
MD5

7009ef0bcb5abd5d94f22b0b2d64563f
SHA1

0b623230797d299f39949f6b5d188bcd655d3953
SHA256

061372cecd8bd05545efc26231fbf14a3ded422f1f408b3110c24cf1fc58f94d
SHA512

f0fdafffe647b5634c12b09e94f2d8d6fe99101c148cc0a9066824bbe9bba0d4b990efad29a0317aaad7f276d119ee0224e8e451e12a0a6aad9de73a3ee5cd71
SSDEEP

393216:xMawbUzY9XVcgZGBWVXcHiH/R6BBPJAhOI/rWB079LqsbEdGi+/InuR6o89:xwbUzY96gYBWGOGRJAkWa8qsX/e8nO

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

disk-drill-win.exe

pid process

1992 disk-drill-win.exe
Loads dropped DLL 2 IoCs

Processes:

disk-drill-win.exedisk-drill-win.exe

pid process

2232 disk-drill-win.exe
1992 disk-drill-win.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

disk-drill-win.exe

pid process

1992 disk-drill-win.exe

pid	process
1992	disk-drill-win.exe

pid	process
2232	disk-drill-win.exe
1992	disk-drill-win.exe

pid	process
1992	disk-drill-win.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

disk-drill-win.exe

description	pid	process	target process
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe
PID 2232 wrote to memory of 1992	2232	disk-drill-win.exe	disk-drill-win.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{E6234140-5068-4B60-8974-5681AEE7DA90}\.ba\logo.png

Filesize
80KB

MD5
bc348d03ed3d614eeb776df9c17dd0c9

SHA1
0d0628742f480a07e08f251d7ffa6d2c671b6811

SHA256
bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786

SHA512
12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311

Download Submit
\Windows\Temp\{2F5CF39F-A119-4382-BE5C-9CA158AC0E57}\.cr\disk-drill-win.exe

Filesize
888KB

MD5
ed8ef613120fd1c3094a48744c37580e

SHA1
86586f97bb0bd81fb8300a45d2de362cc71c699e

SHA256
5689a5c40b3b778165914ff22ca3dbf875d4cf5ab4b30390ad20387f86cf9d48

SHA512
e7d0b5b0fcae1317be05e251667556b14327bb4155b6ba0435c2413c655db4c766fe2585a195dbda5fa54477e4e523d97b16a59206a02b73ac77efdd8fb4f029

Download Submit
\Windows\Temp\{E6234140-5068-4B60-8974-5681AEE7DA90}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit