9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe
Size 407KB
Sample260506-fd47qaew2q
SHA256 9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5
MD5 0d6a710255df8d462f642c240a26284c
SHA1 f34e5c9d91a596398bdc4386f46e79deefa83651
SHA512 c8d095116bbe0b7d3a0f01013c3624a226551f3c85d3ec123689598d803f37dd0b20adad11a661bb44a3203b2f6cc6331342326f7eb608cfa1971cd60f7004b1
SSDEEP 3072:e6N6AtYqL/kJG0aVDw8gyk/Ap3DO8vDBZMCdAMdobLSNDX7fT6XActG9ReWB5gu6:zN6A2gdgfe3Ddv9ZM7MoQr7iA9Tpz
TLSH
T14694E517A6EC3CEAD0768238AB7747C5D72EFC0503A1D58F13D00696AA3F592793A790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4180	9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4180	9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe

C:\Users\Admin\AppData\Local\Temp\9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe
"C:\Users\Admin\AppData\Local\Temp\9d75a5199e86a23300f9e3cd29e2df55b3dceece153a7e877cda7b3f3f2195b5.exe"
1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4180-0-0x00007FF783010000-0x00007FF78307B000-memory.dmp

Download

memory/4180-1-0x00000284B1780000-0x00000284B186A000-memory.dmp