Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe
- Size 2.1MB
- Sample260806-jmh8dsfq5v
- SHA256 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021
- MD5 289653fbd1c849c9e0d980dd1c5380be
- SHA1 c0c79266023425dd5be35cb9598a28d5537cf7eb
- SHA512 df0f41cc2998187df7393a5e55f254e352133c932feeb89c6c07a8882ad043ebdce8531ec27b1cec4b7f42727b2523a5bae49da2ede2c8577d261af2acefa774
- SSDEEP 24576:q6wvJVFotffOQrGsJnB4eESHdVsYOrN32uT6Trv8Sn3//ubsp1CrrhpVTX4ugZBy:q6wvJDooQwczXi2uuTd3//xnCBTX4n
- TLSH T173A57C5AA3A881E8D0B7C13CC556A34FE5B238154B608BDF13556BAD2F33AD50E3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\I: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\L: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\M: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\O: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\P: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\T: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\Z: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\K: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\R: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\S: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\U: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\W: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\D: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\H: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\J: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\N: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\Q: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\V: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\Y: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\A: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\B: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe File opened (read-only) \??\X: 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2804 5ab4d7193745e89e6c6edb235a849c33073f85a02a6c466ad7123064df3b6021.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 3KB
- SHA256 0b347dd3784187996dd2443a8abd61100e6c76cb928b165a7119ec8d16f6e6f3
- MD5 8b16af2e63a02c95e4e6da698be1af44
- SHA1 14b4c6f9afe2ddb951728c69a3f8d31d1300c344
- SHA512 fe06f0a7df82899ebb6a661266d0e7fb7a46c0ad6e5d8d69fef5b122f1af7e4238b4e7e8fb22bba17fb725a1c119e32e1cd0198ace7b361bc560ccea21fdec9e
- TLSH T14381C10605D40766B05D86130AA0F2A9FCAC5E18AF663BADBDFFA5FD0723243465D70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 4KB
- SHA256 540392b4655e9c2a90cd96bb02732513189eb111830b7aa8577ad4f616fa88b3
- MD5 2dc53e7573aa949398c3809b3f067a3c
- SHA1 f9782ee0ee7edd61473359c6a0a006d21170bf99
- SHA512 b3a6f5cd1b8f3ad72e67ea4d459a7bdfd88202cb80f3c56aa9db6e681adda769a2b90e9c5ff0d9ae1b85f671ede27e57e05b561068e23108d59739b42bdd882e
- SSDEEP 96:kfDqz96ljCrBJiV5XDXnIHqdFOZahO4Bbel3M8wJ:ADqz95rqV50tEbw3M8wJ
- TLSH T1ABA1D20601944766B15D86530AA0F2A9FCAC5E18AF263BADBDEFA1FD0723243475D70B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 1KB
- SHA256 6c8ff162fd5bd8d78297fd77cb6829828d1a8af9332f5b92bf46b9732bb6e00c
- MD5 5a846fa65c1459bddbccc2f5f68afbf9
- SHA1 02e3edf145db377fe3acaf9239308270255f0859
- SHA512 3bfa6fe792a3625fa234406cd9a44e5293c81f28a72eec1e4eb79a31446c1a4793ae652a3e2f75a28aa8911b7a7ef34135ed3eccb9d44646f3573a998078904d
- TLSH T10521310A41D00A56759DC5130E90F1A8FD9C6D24AE613FAC7DEF95FD1733282825EB0B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 2KB
- SHA256 371fc4a01d3e0f54b2a7bb25a2aa77751edeafa478278198392b72272117f52f
- MD5 0fcac79b07d7a74c67ef06d3e1a6c90e
- SHA1 0117fbf81147039ca9a503d01bf8ab82b0d1a3f4
- SHA512 c84dd17cbe54ac335248d2fa9e14001d2a4457e241ddc75a9e8f5ef118eaf051ac3cfb6a2ff01c7c4908636db148178f318410fe410f69aece109bc9f0a30af5
- TLSH T17E418F0615D00655715DC6030DA0F2A8BCAD6D28AF222BAD7DFF95FD0723242465D70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 2KB
- SHA256 a4100ee1c04cf833b7a98cf5e1de6ad47ee3a0cd167b8642f22bb97c6c2258f7
- MD5 5874ec3f7d177720463f8e83b644b68f
- SHA1 333b21f17b050a43174d17d8ffe0f6bcc70da3a0
- SHA512 65119d7d3ed58cc441b5d94dc1cf622c33a39fefbb4a14fddccb512cc5d64def77694d5c50e34d6640beedc2bced3f88b9f6f4402ec505237c5be41a0c8c7971
- TLSH T10151900615D00755755DC6030AA0F2A8FCAD6E28AF223BAD7DFFA5FD072324246AD70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 2KB
- SHA256 ca321a80cc80d8f001694525626a73df0d8a84d7863cd40cf6a19021420342c4
- MD5 cb2e4c4509ddea063241c784f98bb50f
- SHA1 6a6724b5aeecab585092b195914bbc00bf937c19
- SHA512 dadceaa2ff94e2b720742f64dbc158dcdb3b7d380de6f8cdf89be1b35cb06beca87114ccf437d3e6eceff2345cd8bca8262db1414f322b953b0ec53c4e620cd8
- TLSH T1C3418F0615D00655715DC6030DA0F2A8BCAD6D28AF222BAD7DFFA5FC0723242465D70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 3KB
- SHA256 48b83bdfa2b0e3b2325d8cc416f67c009a85d78786876a5c47972d5991dfca18
- MD5 c3a105859b37427e5bbf5f514a481211
- SHA1 a1558e789f63a018acb3718d27bdde4c13c52f66
- SHA512 dec5aca39662a2cea40944d87bb888479b9459e09711e678217dc0c2a961f5b6ab8b8f3ad5c7f744bf376ca8e8990d7db412e41eb2f48c42022fdfdc3def5dab
- TLSH T18C51A10611D44755715DCA030AA0F2A9FCAC9E18AF223BAD7DFFA5FD07232424A5D70B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BGI.log
- Size 3KB
- SHA256 7b68bf8d3cb9eaa0b8ff48d35c18227ad6257c2be58dc99a67c8139cf59a7795
- MD5 451cbbd4dd94f9f3cab88cd5d1b2a76c
- SHA1 85c0e60169d23e6b09d261430554b1fe8f87c4ab
- SHA512 c13f98f1ce36d9f3cbe97678970d3306ded066230c6bc61a883348ba1f7e90645484753d1bd173c41a4cb278e2593dfac96b3ea4446d7f0046f7bb52aff1d01e
- TLSH T1A661A20611D44756715D8A030AA0F2A9FCAC9E18AF223BAD7DFFA5FD07232434A5D70B
- MD5 SHA1 SHA512 TLSH