b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
Size 967KB
Sample260809-ec7qsatsdt
SHA256 b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05
MD5 adc1964a9d66703a2aed2453a481ec00
SHA1 4b16674253f904689f35be15108eade92f557662
SHA512 3c36c3e64d9179254cbfb83ca9d84e46a8953c75c9548825eeacbd8dbc5c63633a690013e1475fe9a0476208b0323897ef1544ddba5de6a60f2f94b32d8ea3ec
SSDEEP 12288:KBAMi8GG/LeIgW3XFGVOJ76wfNtmOBvtX9WE3:KBAMLGG/LeIP3AXwFttd3
TLSH
T16E255151F3F88A5CF0F36A746DB642D56A72FC20BE34CA4F6610B64E1A71950DA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\W:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\D:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\G:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\K:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\M:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\Q:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\X:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\Y:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\I:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\L:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\O:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\S:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\T:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\Z:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\N:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\R:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\U:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\V:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\A:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\B:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\H:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
File opened (read-only)	\??\J:	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
5116	b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe

C:\Users\Admin\AppData\Local\Temp\b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe
"C:\Users\Admin\AppData\Local\Temp\b0bee52bf56eb6b5b37e2e261c5db9d038b9b74c967fd6c45fb534ceb5a5cd05.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookAW
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads