Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02-08-2024 21:28
General
-
Target
Spoof Instructions/Spoof Toolz/OtherIDs/USBDeview.exe
-
Size
189KB
-
MD5
5c1729d2611fdcaeeadd238c1f0427c7
-
SHA1
ddcfca0994cc92783d6a942075166f026c88ed07
-
SHA256
95e50f7eea21bfed82a34a24bc5d66029146c7b988e889b11f30b45cb364dcf1
-
SHA512
47c608e0590e1f73c32a0c677f9b81738fb188b27243e99d514911158d673f18ae7ef99ea897e87c850c5588eae19e3d6ae8736e0a974dd51f438f5190e362c5
-
SSDEEP
3072:3FSG80yvkmcA4bEvLhWoLdpxgZZapW9T8iXcWWbgYrrzwKeugTedajIHNNSP7g8x:fyvkC6EvLhTLdpxgZRbWJdBHNNSd689
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoof Instructions\Spoof Toolz\OtherIDs\USBDeview.exe"C:\Users\Admin\AppData\Local\Temp\Spoof Instructions\Spoof Toolz\OtherIDs\USBDeview.exe"1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken