Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
17-06-2024 15:40
General
-
Target
disk-drill-win.exe
-
Size
27.0MB
-
MD5
db78eda8cb52e64d403890ad2201f007
-
SHA1
174c837386ce92144bb6c8d722e4809426b2519a
-
SHA256
97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee
-
SHA512
94691338ff0b788b16eed3eb2973b2534b5c7774ceba3aba11a2f73ee4d9e754c8039d47ed3b45ab55ea3e3a6f7138c5a70a40f516397167a97a36c2773c09ad
-
SSDEEP
786432:Ep3+DT+fEKOIYSwpcPa39JWJ2GsaZ/mCoq31/:l+MKrYSwqPa3HW7saZ/mPYJ
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{4CC060BB-F4C6-476F-A674-754F1C816829}\.cr\disk-drill-win.exe"C:\Windows\Temp\{4CC060BB-F4C6-476F-A674-754F1C816829}\.cr\disk-drill-win.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1882⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5bc348d03ed3d614eeb776df9c17dd0c9
SHA10d0628742f480a07e08f251d7ffa6d2c671b6811
SHA256bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786
SHA51212b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311
-
Filesize
888KB
MD5ddc2103d7db9f4b5ba331ed09293a336
SHA173bd031762f1168a4d7fed65bbc1663ca6cceb3c
SHA256386a38dd828a617f60d11719ad5eaa3fa21a21b46f3871f5b4553e9f6e67aced
SHA5122e77b5c6d7562bd23d1372903da819c5a905f791228dc89317159e9ed2c32e7dc40bb2067de6de3b43a887d3799b58fd44505d81fae3b6348e64bedeab2effb3
-
Filesize
184KB
MD5fe7e0bd53f52e6630473c31299a49fdd
SHA1f706f45768bfb95f4c96dfa0be36df57aa863898
SHA2562bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80
SHA512feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c
