578993fcf8d57252bc34536c01dc853a374e60def68f60b2826c3de0826ea00c

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ventoy-1.0.99/altexe/Ventoy2Disk_X64.exe
Size

633KB
MD5

a58b82d238c6abac8fe55f14b6011d90
SHA1

ee1c7d6ff2ca5cf3af53524518f4fa3973f4db7d
SHA256

74cbd7ddb84474a0207636c5f73577c9b746b0f1d7768fd3c21deefa35a910c5
SHA512

bb8a75eae39ff4e7bc8e22c0c1e6fba1d33a7b45ec28cfdbe6bcc8841f24dcb1e478e20090779bb8179df40b537ccbaff72fd3fb903f1dd305920e1197ad78c3
SSDEEP

12288:seO5Hmk/10nJQDrQ+27UQnVWqqPIBONhxsU5:Ywk/UwQ+MI/xsU5

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Ventoy2Disk_X64.exe
File opened (read-only)	\??\F:	Ventoy2Disk_X64.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Ventoy2Disk_X64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\Count	Ventoy2Disk_X64.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1196	Ventoy2Disk_X64.exe

C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\altexe\Ventoy2Disk_X64.exe
"C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\altexe\Ventoy2Disk_X64.exe"
1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\log.txt

Filesize
2KB

MD5
8942cede2a5c1f1d461acfb369b81691

SHA1
2d920be1b9511d506c6276414b7ddf216db19323

SHA256
db125163cfbe17e0ba8d56582065bc16548a6bc5c1c2e62e8b341cc8e5601ab9

SHA512
e3e5048b001907945cea1ddf4fc3ebb0f8d713ef088326799e714bf0827e719547a1358e00606b779de946d2b809fe5dd415a5e53dd884df70e8f84bcf0c4c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\log.txt

Filesize
2KB

MD5
eeab56e4cfaf96064b25676be6bd448a

SHA1
ce43f5dd59c40d7a91578e6cb00f6ba5d8aa6ce9

SHA256
a19b2acf9f9b611dff5d0d05243948c321f763660d89915080cac4f487f569bb

SHA512
689853ffc13953672f580d9851e5d5bedafcb645771197de12a7d0274197abdd476dc14c212374fb0e6eca9977d6c5b40495da97bcf6b54332632c923921a538

Download Submit
C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\log.txt

Filesize
1KB

MD5
a83887b063d8d66650e3a6426c0085db

SHA1
37c0edc2bf4732b68d0c4ff4c4caa3edfa8d41cf

SHA256
ddd00878b1bcc2e4751057a692abab4dc48ac4bf0ab41ea7c12f4a29c336309c

SHA512
cde56d620c9629da653a4726ee2111afb31abb975e6e548a0346a700dff0be4f6664ce2b525110a560d84220e67ea556718bb4a8a97d0ef4e734bdef1b899978

Download Submit