97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee

Analysis

max time kernel
39s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-06-2024 15:32

Target

disk-drill-win.exe
Size

27.0MB
MD5

db78eda8cb52e64d403890ad2201f007
SHA1

174c837386ce92144bb6c8d722e4809426b2519a
SHA256

97e296f77f96ea55d1e0f962f0fe980170a4e8d11464a7ca45b2976aa8ee16ee
SHA512

94691338ff0b788b16eed3eb2973b2534b5c7774ceba3aba11a2f73ee4d9e754c8039d47ed3b45ab55ea3e3a6f7138c5a70a40f516397167a97a36c2773c09ad
SSDEEP

786432:Ep3+DT+fEKOIYSwpcPa39JWJ2GsaZ/mCoq31/:l+MKrYSwqPa3HW7saZ/mPYJ

Score

4^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 1 IoCs

Processes:

disk-drill-win.exe

pid process

4504 disk-drill-win.exe
Loads dropped DLL 1 IoCs

Processes:

disk-drill-win.exe

pid process

4504 disk-drill-win.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

disk-drill-win.exe

pid process

4504 disk-drill-win.exe

pid	process
4504	disk-drill-win.exe

pid	process
4504	disk-drill-win.exe

pid	process
4504	disk-drill-win.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

disk-drill-win.exe

description	pid	process	target process
PID 2036 wrote to memory of 4504	2036	disk-drill-win.exe	disk-drill-win.exe
PID 2036 wrote to memory of 4504	2036	disk-drill-win.exe	disk-drill-win.exe
PID 2036 wrote to memory of 4504	2036	disk-drill-win.exe	disk-drill-win.exe

C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe
"C:\Users\Admin\AppData\Local\Temp\disk-drill-win.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3764,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
1⤵
PID:1084

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Temp\{10E38D61-B97C-428F-AA1D-71FEBC3AEEF3}\.ba\logo.png

Filesize
80KB

MD5
bc348d03ed3d614eeb776df9c17dd0c9

SHA1
0d0628742f480a07e08f251d7ffa6d2c671b6811

SHA256
bcc352480c5bb9be1021442b5f1c948a33504d75b9c76f899eb3244e0b40c786

SHA512
12b12b6ccece3de9e76562ca83e078cf502e0de34747abe84f70665bd2727f4cdd62d04a1811095440c5f52fcc2b4a07f3c45b2fd3bf7d1933b596a09b5cf311

Download Submit
C:\Windows\Temp\{10E38D61-B97C-428F-AA1D-71FEBC3AEEF3}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
C:\Windows\Temp\{E74622BB-C22C-4A3E-A2C5-C79148299534}\.cr\disk-drill-win.exe

Filesize
888KB

MD5
ddc2103d7db9f4b5ba331ed09293a336

SHA1
73bd031762f1168a4d7fed65bbc1663ca6cceb3c

SHA256
386a38dd828a617f60d11719ad5eaa3fa21a21b46f3871f5b4553e9f6e67aced

SHA512
2e77b5c6d7562bd23d1372903da819c5a905f791228dc89317159e9ed2c32e7dc40bb2067de6de3b43a887d3799b58fd44505d81fae3b6348e64bedeab2effb3

Download Submit