d8b7171e13bc242e115b127cb6f8d87cf2e830c9a9ae4f0baceeade8edfbafb2

Sharing

Copy URL Twitter E-mail

General

Target
Pro.rar
Size 100.0MB
Sample260709-d9wt4sct3n
SHA256 d8b7171e13bc242e115b127cb6f8d87cf2e830c9a9ae4f0baceeade8edfbafb2
MD5 94bbe18395d2d35fd93a9ce032045083
SHA1 d9eaf146c4356cf2ba2019a78d8c3a2133659002
SHA512 82025b1aaaf542b05efad2cc9b33b1199bff0864a33b47c2512a68e4520770dbfe2b9ce7607e9c8c9899dab2303624a51caf388f05a4a9d905ce05dffe5d5ece
SSDEEP 3145728:5MO7rvo7fhsGiIwOpzZCYA0pgHdDiGtzx7JU:5V3MfhspNiMYrwDiGtQ
TLSH
T1AC383352FFF7745E226BDCA5687C7D180FC3A8D149299396F4AEEC68902442C91A343F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Pro/Capcut pro activator.exe
- Size 8.8MB
- SHA256 8db41d265f01bb991f6fc0705e97301ccaa684275841dba01937c431d16bcade
- MD5 613671469c12f50265e9be28458d089e
- SHA1 c0a5a7d404fb01c0834055a69de25b4c18bb59db
- SHA512 5e4e2b321f56f632a84595e93c2eff6406da56504858836d589ba290f109ea4898b7a69ddbeda9b25b749b8596a0eb9956354029c377a49f0f7e5eb3cda404b8
- SSDEEP 24576:SlNfvRYDxqxmo8E9VghQJc4P6iWO0EhEtJUxwM4uDvqN+0f1QtxzBele5rK2p3l7:SlNXR4x1ov7MiOROXhgJZ4DSN+Dz/2Y
- TLSH
  T10F96AF4B7CE009E5C8AA5336897652927B70FC494B3127D72E90B6783F727E18C3AB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  Pro/chrome_elf.dll
- Size 2.3MB
- SHA256 db580e37cabd8a804e48ae9035383c6b7e3e9ddbc8d05abee242fd3c3ec7c8dc
- MD5 a141ce49faee3e4402ec7b22b2739bcf
- SHA1 42e56ef060a438591bb2642ff05b519bb2eb4b2c
- SHA512 81219091d8b95d7a8133e8434395b3770a9835e4fd82c234af2c346deaf3e9e570908390a0250e76c08cb898fe953b62cb9d5eafc5bcf9c587f74c1b86fe0279
- SSDEEP 49152:6aI8PLKkBrx52j5gjCOQ8fFp6nDIFazNBlPAHR:6aI8DF50g6MMDleR
- TLSH
  T1F6B57C13F2D901E8C05DC1798B5B9632EA61BC460B35B6DF0AA076161F7AFE4673E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Pro/chrome_wer.dll
- Size 115KB
- SHA256 62c426bf55911b226b9a46c3b6ddcb58d8ad853fdd43a4f12d44750e31a5ce2d
- MD5 37a3059ff58213cc1fd854096d0d7e76
- SHA1 6e130c3c5b123e79c1ba588d19d1a8f6d90f298d
- SHA512 de9ec1368dc9eebc8866ded25a250392159ca20391eae334a7b8f3959345d4ad7beff34e5b1f188e5d2410d20946afde1096a981cf17f4fb69df88d58f96cab0
- SSDEEP 3072:snLR29KNnTNX3ZEng0j4RV4eWAtpFrpqpqpvIwT25k2hdW:sLR2aZZf0j4RVznMu
- TLSH
  T1ACB34A5763E900BBE5B7863884634F06EB72B8124761ABEF03A4421A1F637D15E3DB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Pro/concrt140.dll
- Size 324KB
- SHA256 5344e1f74334cce06b8cd14a901e27d29a1708c786fb7ad3281a00044205a051
- MD5 ae936484d159ba103c3b9b4a3c9d8d19
- SHA1 db719198108130aa109964ea6cd544f912735a53
- SHA512 d108b816f85c758b5dda1a22e761f607428e4a0e54f46a9e33b6fdd67c27dd4151a75091510eb8091924ed703dcba26db2f6bb5c74b5fd58e104ed42d8e05637
- SSDEEP 6144:lpxc5oSb/fSpwaxspxI6CLwaVInWzgFYxNxKYSF:lPc5oSDfStI7qz3lPE
- TLSH
  T16C643A8A76580CE6EA67D039C693C50BE6F3B9452352C3CB1364938E5F677D0D83A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Pro/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 464ac23f4a5e5d92a9e99f92641f3a0c5e8326b378a45140dd9f880686b9d1e9
- MD5 fe8b95e5941a2112c16858945f952d8f
- SHA1 72325b2fe4e1a6d3a3f7b623843eeb61c9162300
- SHA512 9d4a00e30c15af6fe0cf6a9b2d4671c7f826c4b2b048442d0b889302ce06410c4b4d4760f19eaf3c6ddeaaff31738dd8f0461d422c180bd64389658f7c5c5220
- SSDEEP 49152:h6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/B:hUdeqt737jFm5w5
- TLSH
  T109268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Pro/dual_engine_adapter_x64.dll
- Size 5.1MB
- SHA256 d5ec2ca6c7c116f57f45b3a80a99664b68f02be305d8d41427f4af877421011f
- MD5 28a22c699f09dba495f45c6ad3f2ed82
- SHA1 461337b7cba23c02a856e426abac1b7c6b9d3691
- SHA512 964dab1d13df07b4f0e69517779d5ed71f682e72651e2b6fec268ddf9fcf2cc02e18d6cd2d003d442191821338f0797114632e28a7c90871b513aef1b9079af6
- SSDEEP 49152:9IrYTlptJDw/NIbupGgQ4HZBlubdkD3TvvOuXuGv2MfvfkMNODsgXmcCxOJm4wwL:5rIl8cFNF7Rknrz64Z
- TLSH
  T1BD365B53F29611B9C00ED9B88B2F5632A5647C4A4B31A3EF0AE936210F75BD85F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Pro/dxil.dll
- Size 1.4MB
- SHA256 3855461625ced4bfc89171ef465b398f75ce1bdef4fc565d850159e35341744a
- MD5 209b426f1b967f86e5de49232d57983d
- SHA1 21ee8b869ec33bbdc097e47847efd2af5f8c6136
- SHA512 c83eb25ad7b7f2365af99fe126cabbb140ed373b0ea82fd73414fb2fcf68a71b0607b13095e258d63d8ebcba70f64ac2dd2ce66a7672686a041c255fd5d08d73
- SSDEEP 24576:ycuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/c:ysHMPzbOxBduHdSCde8ZF1/0Wy4oV6bB
- TLSH
  T11E657D6B66A800B9D4BFD174CA438E0BE7B2B45503B0EB8F16F442A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Pro/eventlog_provider.dll
- Size 15KB
- SHA256 ab44220f0647d6d1a5df27d11be725a937b1a096b620638bacef5ad01db50646
- MD5 f1713aa15b05fa70bc45d6eb186e651f
- SHA1 663163f56f6829b2884cb109c68aa566914e5770
- SHA512 4e70ef67f7b3492e7dc842b3486ce2ecf845f135426a2fb94514b74ad083b4fc60142dca7e2a3afab0a3a4b9dea3fd7fc9f4d6682e8520139963296c73f825e4
- SSDEEP 192:1qqnWd0LVWc6Wz2DWHbNpofeBWseaAWzQcNpcspKLX01k9z3AbJ98Jt:NWd0LVWcr2y4GlNSscmeR9z+Jy
- TLSH
  T1187229D697A88502FD9AAEB052B8CD533D3CB7C21B1096DB1682F0581C627C4FF3066E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Pro/ffmpeg.dll
- Size 2.9MB
- SHA256 2709ac9a18ec0aaefeab7e096db7cb7c06f7f87e1026d84b15579e2631662a25
- MD5 094ca551121772f22ffa0640ac658796
- SHA1 c657f698c435f2b7fa3662f66f9fca6ff0eb321c
- SHA512 f019ee2f6b334bbc972020dc91f1c138405b76c49ead9dffc15554ae5f204401c61780dfdb007cdce4866f699e22f5915556ccf4306df6c32b4feae52651988f
- SSDEEP 49152:RoZr/c81IQbx6i1N28c18oSh9aLuS6FnFizu6vIGqB9OG+CJtcjA5m:RoZr0iaLu/ivvO9bD
- TLSH
  T17CE59E02F6D251EDD019C03497ABE213F271780A4F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Pro/learning_tools.dll
- Size 1.2MB
- SHA256 c4b3c8846438fc2461dc8603d1e47e3871c8e5fef4a30a8b1894d485a8715c9c
- MD5 eb043f6a58ba277f85cd08a0ec26aa32
- SHA1 600f9753bd9bf8c5c45df21c73372aa0a6dc5385
- SHA512 f34915d2c71d846b5805693d5fa6120b958cd39865dc1c3ba865e7ad0292cdd8e6cbbd1df0cfe95b7aebead6c62d6c99b3471a60265f7c71dce5b6501d03b574
- SSDEEP 12288:WA6pUB7ugVy9gb9DvE9GeEJNklh3YgkLcIzOcaQoVgkLcIKcaQbgkLcIZcaQMsnI:WA6pUBMQFeEJNklh3pvsnv/CHgXxpgn7
- TLSH
  T10C555B2172066837D99E81B5E8735283F3707882251744FEB21CDDDF2A6EBC521BAB35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Pro/libGLESv2.dll
- Size 6.8MB
- SHA256 dca8d78efd1cc0823c3b044ddc8043035e2e21467705e140a6409d732eb23670
- MD5 155b895c53f0a3aa401f9e4850636fc1
- SHA1 316bb486a4b2eda476e5e9e3eb29814bc115d69d
- SHA512 61c90a3d045895cbc9395b541dc247c312a8338a802b68eb1426aef3572639f0849d4d05459529b900d40445eb3b345564f4a952c15874a9d92ce3c84d339361
- SSDEEP 98304:Z/4bGKn5Ot8E8LQIpKeZJD4ZoLS1ckAC/67:FluPZUWS/i7
- TLSH
  T162667C03F29681C9C01DD274976B8623F635BC850728B6DF269457212FBAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Pro/mip_core.dll
- Size 5.2MB
- SHA256 b91132b09bccc01df0d0a168691bb9e3720d7a5c0f69f1fd838ea6f87cceab0d
- MD5 0622b767e9e89eb0edba095d3219d660
- SHA1 6af7744dfa8af85bc2d54954f1586e968dd2a3ec
- SHA512 2e0562acfd3faf7e102cc1380df05efba88fe29f95333cbaf1cca44b44a4070ea0bd056ec6ab7ece86b921a35ce5b50708c68a3a9f427ec35349d9c0e412591c
- SSDEEP 49152:DuBYH146Mvl8bR+WM7ZvaL4Zrzi8n8sJsRrlurPuTtuGKc7mhT5Ci6uBtiLVja3c:/14lLfzhuTJytXiYjGPwaWu
- TLSH
  T12D467C57B7A800ACD4BBD27D8A4B8507E7B2B806573197DF02A0577A1F67BE15A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Pro/mip_protection_sdk.dll
- Size 2.4MB
- SHA256 3e46c961339de0359adc33e27aeaba932fb609304bc764aa0fa49b7d11dcfd78
- MD5 17ac1c062c43f00b3ebe5bb15f866a5e
- SHA1 9f8f3001e81b4d64a1833e071782f22caf44d7ba
- SHA512 6a57422a0f6e0cfdc18b1a57b3153d4b2179c8a79125e9547ffe7158356dbd580bd664d0336a3e33a95d39343b0216b49a794c8506670109876e58bce750b51b
- SSDEEP 49152:OxFDqq8uX+lXcW9vDbslAbjE/rHnULSv+F6i8a3isHp:r1Wmp
- TLSH
  T182C53C477A554099C1EBD2B99B1BC943F234744A0334BAEF039097572EDBBA0AFB9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Pro/msedge_elf.dll
- Size 4.6MB
- SHA256 20150099f08f29714d52137f6d2b9e9799bc031c4f7228912772643d2e634bc3
- MD5 ea68c6ee94337a94f8a3d461f1d67917
- SHA1 5e058eeb6f47f8a0053ca453db506482ea590021
- SHA512 b54651c5d58b7bda94d89ca328bc4f9130ef5ebcb04cea721cbf4a32d3c24eb7173a3ad3dbbec5695a8ad3b5ae7471456681d03941bf0155bac35dbd09863722
- SSDEEP 49152:3FG9S61PDnfxmn2i6TYTcNVoWc5mpJ9QTj2rTGCVOxZzZwY9mJWuoowUzdtYgdZv:Turyf9iTAPEnwc39tRVye
- TLSH
  T1AD264A43F25211B9C44EC8B4CF2E552297643C8A4BF193FF25E83AE11A75AC97739B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Pro/msedge_wer.dll
- Size 115KB
- SHA256 6d5ccc1720656ece210fb98641a4002409d0b9900d3cd9fec911b526a97aac43
- MD5 be1d7da17218e3d786bb45fe8453b85c
- SHA1 a767dbbbdd063c7122d50e93e0a769489d48b0c4
- SHA512 cd6f0fd0e45e0025446ad5736a6486f7a0cbc8a3caf1102e376979256ed3a377d2a5e74fa32824c7df38171ffa1cb3742076de053b12f1569245a7e1776f84c0
- SSDEEP 3072:k7RSOBa1Trm0O31k0IeYIycAtpFrpqpqpvIwT2UczzYafHPBA:iRSAsv4k0IeY3hIfYh
- TLSH
  T1B8C36A5763B900BBE177863885634E45EB76F8118720ABEF03A0425A1F637D19E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Pro/mspdf.dll
- Size 18.4MB
- SHA256 52c9c7b146d5d747e113b4b35cb4c703162f2d985ea242ec4291db54f7377bf5
- MD5 b0785c4d57214a791643ba9d59549cf8
- SHA1 35fa9f69941fce1d1a29aee164bc956f82b87aaf
- SHA512 bd568668ea2b5ed5a93504de2091ad845d4a27c28deb330752d9392d30d149b313a6f59cc133d0777483099b71300ad11916da8514dd8081decbdc09e7855961
- SSDEEP 98304:yK20/CdTySbSI8/tkyTQQv/45Ok16RMBQjhWOvPy/UO0JV6xEnwjql1UntpC4X0I:yOTTQQv/45OkMK/7Y6x9bX
- TLSH
  T1C6176D06BB9A49EDC04CC874934B86535E20B8CB0B75E5EF45C962192F7ABF85F3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Pro/msvcp140.dll
- Size 550KB
- SHA256 f23ec08cd51a0377de3d5e15265f28696e3602270df6f9057ace13a26d9a48bc
- MD5 ce4433a1b66d6e3f123d4853ab31b79d
- SHA1 1c5d64e4f7147928835e7b3260d81cf448a651a0
- SHA512 5d933333a69ae1f12ab1aeab822caf5f975a685464d782f8b582b92e84a331ccc80258dd3251016f73561dd3cbb0872b5d781b2d30dba96451ff5da388fd483b
- SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7h:K0p1F/IiQEKZm+jWodEENh
- TLSH
  T1C7C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Pro/msvcp140_codecvt_ids.dll
- Size 40KB
- SHA256 3ad45d2800f13e5bedeb1e0fddfcd40c392622bb8649c4321992d097941518de
- MD5 74e1f207b7097f6a35cb073e948fca20
- SHA1 f8d00e910218659f08301761bbf4703e29958109
- SHA512 b68dde42ca484a498a9f7b56090dc6d73960cdc0dc75e47c334883a780b6747d32204733a719292c2d38be1b6b8b27485f0f2dd8c332ece40a4f070b99741fc2
- SSDEEP 768:2wA1mjzzGgU9IX+09zo8AjCf9zcfFJq09zoL:2wA1SzzG3e+czopjozM8czoL
- TLSH
  T1B8137DDADA788083EEDB5DB082A8DE877C3CA3C70A5095A71362F1540D537C5EB3426E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Pro/oneds.dll
- Size 3.2MB
- SHA256 af48988967bae769f3031f0d9fabc5ff7bdda72e8224050190a16988de21e611
- MD5 d2fd39d1eeb4f74da30d0e4a0c4a701c
- SHA1 0efaf97c0a7f477e4d9502b9ed168691c57eac78
- SHA512 8cdfd1cd1104fb34902ad1f15770fbdd21fca07b94658f21d37d7b55e7ec0c0ea6f35ae483d76e08fe6b760fec64e5030232b4eb63662376a4b2d7785d4503df
- SSDEEP 49152:oeqnNyCB3ocUrGaXdWycnZT+S2cKrVRzTMyBf4MVOZtDc:zq4XM7VcZRfceOZBc
- TLSH
  T1B1F56B03FA5641B9C08AC174C7678733AA713C8A4F74A6EF06A856153F7ABE05B3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Pro/onnxruntime.dll
- Size 3.1MB
- SHA256 1f11ded7a52be5994c8944ce4bd44d82e0a63c955688aa8e727cf22a9c65a42e
- MD5 f17a75200adbc2ee4ed315d7cedadc66
- SHA1 2cd0cb4e486ba2955f87d2faa3897d31ba15f6b5
- SHA512 488241130a49b82e988bac83932334305c2bbe5b5fb73a1cc0ac03811d577f78bde287695702b208bed5d9c2b1708c41ccbe984fa777110ee9569ec72f95be74
- SSDEEP 49152:89dUKzyhC/ni1yzbArKqzr/fpSILTSPtBgwZ4iruMF/cH9nmoh9kXpw9XpzwYMNg:VgBm
- TLSH
  T154E5AE2AA3E802E8C07FD179CA4B8A17EBB27449C3705AD703F185552F6BBE0567E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Pro/onramp.dll
- Size 457KB
- SHA256 eec93ba0b1117a912873f7bfc14d3036fa29f271d165c32a5bea95c3de771e07
- MD5 31fc305e4a030ced08b569b832e87ade
- SHA1 6c685bed65faa2b8bb4c9ff016c12cf0f371f565
- SHA512 fea0ff1ce0db9294718c46af610fae55e59afa2e1014268d9a399d26279c3495b7934cafa4c4a8704d025e378ce7fe1a5dc88902c35849bfb921dc32566b8637
- SSDEEP 6144:OrsZeXqDVPrg10lHXTGbdwS1DpVZk4xDcGNegh6td6f:OrsZeXK8IXKwS1DpVZkac8eghAc
- TLSH
  T1A8A48E05B7E448A9E076D1388A538947EB717C960B61F6DF03E0E2792F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Pro/optimization_guide_internal.dll
- Size 17.7MB
- SHA256 608239e89a43fc482cbdd283c42069671478534c0fded508d780dac603ac1611
- MD5 d31f5e7d0e950514c860430c5ccb8f43
- SHA1 d51cdf30bfc673e66a76953b2ba0de3b9555d1ab
- SHA512 294e511ebc65ff40cd28c88b8793afea01e69255c72c3b9312131ecc3c74474822c856625abf3ab4a80d5d74697f94dd1030675f740afd4125f97a0133ce8a1b
- SSDEEP 196608:U2mEIQDREt+AbmuTDILo12nvjUs5q9Z5j4Mc:6BbpPC/nvjUs0j4Mc
- TLSH
  T1BE174913E2A641D8C05AD1B9475A9233FA617C494734B2DF0B81BB122FB5FE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Pro/prefs_enclave_x64.dll
- Size 113KB
- SHA256 27ef7b33f09808b3f1b23a5d1f3bb057e5774104619b23b0908b620d074a41e6
- MD5 6284d259ba392db0e45ba4446a735863
- SHA1 71d484a0afd3b25996000566d24941d18ff458d3
- SHA512 3a1211577a933cb8d2136017fd0e6da4aeb6d76ae895172370e88088eff5b23e446d25cf9027e9a83ae3097e47f5e2d6c1ced636c09445f56078b2a2cf9146da
- SSDEEP 1536:2hk95BP9K5dv0EzEd1GP4ufY8OZjknvooLqF1Pm1Yzgizh:2i95BOMEgHY8mwoLqF1PmaPd
- TLSH
  T13DB36A46B26442B7E66BD175C5D31E0AEB74B4848370A3CF07A94A950F23BD09F3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32