9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a.exe
Size 4.0MB
Sample260730-cqc28aad89
SHA256 9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a
MD5 51829f9e0bfdbe43e9dab5c2a1bf612a
SHA1 f743dbcb4179924b52a4e3d2b94d65c9d35f72a6
SHA512 db0ecdefc366b523ef4456a95aeb12de4c0ee92d9bd21133058cab603ffa6c67e4d3a2bbef41644ad3daf867ad5d4efa952b1ad26f84afee8502e4fd4366b037
SSDEEP 49152:v4s06RDNSae1VuL4HjQad1BN844Bc0WOjAlL0Ua9DJZDgkibdLk:bhNMZDUp/evk
TLSH
T198164B6A1EFC4628E466C17C9A6757629AB2B8003B35E6FF45401095DF307E0B73EB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a.exe

C:\Users\Admin\AppData\Local\Temp\9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a.exe
"C:\Users\Admin\AppData\Local\Temp\9cbfb576e7ba838973f25a6151ca145b25725dd16d188589201339a6fa712b4a.exe"
1⤵
- Enumerates connected drives
PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4760-0-0x0000000000400000-0x00000000007FA000-memory.dmp

Download