578993fcf8d57252bc34536c01dc853a374e60def68f60b2826c3de0826ea00c

Analysis

max time kernel
95s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ventoy-1.0.99/altexe/Ventoy2Disk_X64.exe
Size

633KB
MD5

a58b82d238c6abac8fe55f14b6011d90
SHA1

ee1c7d6ff2ca5cf3af53524518f4fa3973f4db7d
SHA256

74cbd7ddb84474a0207636c5f73577c9b746b0f1d7768fd3c21deefa35a910c5
SHA512

bb8a75eae39ff4e7bc8e22c0c1e6fba1d33a7b45ec28cfdbe6bcc8841f24dcb1e478e20090779bb8179df40b537ccbaff72fd3fb903f1dd305920e1197ad78c3
SSDEEP

12288:seO5Hmk/10nJQDrQ+27UQnVWqqPIBONhxsU5:Ywk/UwQ+MI/xsU5

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Ventoy2Disk_X64.exe
File opened (read-only)	\??\F:	Ventoy2Disk_X64.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	Ventoy2Disk_X64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Ventoy2Disk_X64.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	Ventoy2Disk_X64.exe
3952	Ventoy2Disk_X64.exe

C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\altexe\Ventoy2Disk_X64.exe
"C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\altexe\Ventoy2Disk_X64.exe"
1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\log.txt

Filesize
2KB

MD5
c011959fc2c5925cac994ce90c9fd920

SHA1
29faf3696db4eeccda936b85762ea4cada28143f

SHA256
9f8ed1c11790354cd9dec81480c7ecffc34ed071634fd4910c362315cdbe0b5b

SHA512
40e884f2d1afe28c5eeddcd9079f73a62376255ed4d5b62f1bae6d92ec229044ef5c6d508a135f3d03abef61e31e3bbd0867fe6dbc7a866dfaf8fb04e8540bfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ventoy-1.0.99\log.txt

Filesize
1KB

MD5
5882659f8cdeceeaab256dced17ee9cf

SHA1
67bc05eb7bc35cb078b98c9f900e5d06fdc763ca

SHA256
afe558c387c2fb7511f5393fb5ba2e5d876dd655fcd8e6d082f36e4d338e4267

SHA512
188506dac041bef1d36e462aa440619c00744958bee9e8dc0a950c2e4dd5f4ba1d21584677a49868633793b47d228091d845bdc021bf019d439828db61c4ffd6

Download Submit