Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 10:03
Static task
static1
Behavioral task
behavioral1
Sample
5c3eb8c100cef5725d79a35664e58646.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c3eb8c100cef5725d79a35664e58646.exe
Resource
win10v2004-20240508-en
General
-
Target
5c3eb8c100cef5725d79a35664e58646.exe
-
Size
105KB
-
MD5
5c3eb8c100cef5725d79a35664e58646
-
SHA1
658426503b19ace88e5781a57f805677474612d9
-
SHA256
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22
-
SHA512
c2e52912c4fa060ca355b4413f379d51ed757ef609b8bb6060e9e2f3686bfaefc101515c1d5b179e5334ff27f36e01de9b4756eba29f1ce311b7dce74d7038ce
-
SSDEEP
1536:MTJxeSgVJ43R2N8gW7YI4z1w+8X5QbdoRPqUw35:M1xeSU4h2NQ7YfF0qn
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5c3eb8c100cef5725d79a35664e58646.exedescription ioc process File opened (read-only) \??\I: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\N: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\P: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\S: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\U: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\V: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\B: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\G: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\W: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\K: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Q: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\R: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\T: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\X: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\H: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\J: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\M: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Z: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\O: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Y: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\E: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\L: 5c3eb8c100cef5725d79a35664e58646.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
5c3eb8c100cef5725d79a35664e58646.exepid process 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe 2076 5c3eb8c100cef5725d79a35664e58646.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5c3eb8c100cef5725d79a35664e58646.exepid process 2076 5c3eb8c100cef5725d79a35664e58646.exe