Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-05-2024 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe
Resource
win11-20240426-en
windows11-21h2-x64
3 signatures
150 seconds
General
-
Target
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe
-
Size
105KB
-
MD5
5c3eb8c100cef5725d79a35664e58646
-
SHA1
658426503b19ace88e5781a57f805677474612d9
-
SHA256
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22
-
SHA512
c2e52912c4fa060ca355b4413f379d51ed757ef609b8bb6060e9e2f3686bfaefc101515c1d5b179e5334ff27f36e01de9b4756eba29f1ce311b7dce74d7038ce
-
SSDEEP
1536:MTJxeSgVJ43R2N8gW7YI4z1w+8X5QbdoRPqUw35:M1xeSU4h2NQ7YfF0qn
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exedescription ioc Process File opened (read-only) \??\O: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\S: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\V: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\B: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\H: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\I: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\N: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\Y: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\Z: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\J: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\M: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\R: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\W: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\K: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\Q: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\U: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\X: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\T: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\E: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\G: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\L: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe File opened (read-only) \??\P: 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exepid Process 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exepid Process 3580 54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe"C:\Users\Admin\AppData\Local\Temp\54dc7635c51ecd94cfe8e45cbac2e52191867b9ff0465d778ee5a200bb832c22.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3580