Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 10:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c3eb8c100cef5725d79a35664e58646.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c3eb8c100cef5725d79a35664e58646.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
5c3eb8c100cef5725d79a35664e58646.exe
-
Size
105KB
-
MD5
5c3eb8c100cef5725d79a35664e58646
-
SHA1
658426503b19ace88e5781a57f805677474612d9
-
SHA256
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22
-
SHA512
c2e52912c4fa060ca355b4413f379d51ed757ef609b8bb6060e9e2f3686bfaefc101515c1d5b179e5334ff27f36e01de9b4756eba29f1ce311b7dce74d7038ce
-
SSDEEP
1536:MTJxeSgVJ43R2N8gW7YI4z1w+8X5QbdoRPqUw35:M1xeSU4h2NQ7YfF0qn
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\M: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\U: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\V: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\W: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\I: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\G: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\J: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\O: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Q: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\E: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\K: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\S: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\T: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Y: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\Z: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\B: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\N: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\P: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\R: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\X: 5c3eb8c100cef5725d79a35664e58646.exe File opened (read-only) \??\H: 5c3eb8c100cef5725d79a35664e58646.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe 2996 5c3eb8c100cef5725d79a35664e58646.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2996 5c3eb8c100cef5725d79a35664e58646.exe