b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
Size 947KB
Sample260809-ee2mjszckf
SHA256 b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779
MD5 e029989b5dd494c48bf130a834543d9c
SHA1 8a5c9032fa4f2c9e1d3422e9c039710b0883b57d
SHA512 e157bf07f1dde26a6c5c71b8a3fc6579381c7b168ee34b2e6862388d74b6198c91cbc675dba4c7f4a8914145d370593c6af13fa0c1efad8d79214b799bab3fff
SSDEEP 12288:5BAMi8GG/LeIgW3XFGVOJ76wfNtmOBvtX9WE:5BAMLGG/LeIP3AXwFttd
TLSH
T142255151F3E88A5CF0F36A746DB643D56A72FC20BE34CA4F6610B64E1A71950DA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\R:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\Y:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\E:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\H:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\K:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\L:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\M:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\P:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\X:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\J:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\T:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\U:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\V:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\W:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\Z:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\A:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\N:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\S:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\B:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\G:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\I:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
File opened (read-only)	\??\O:	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
3144	b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe

C:\Users\Admin\AppData\Local\Temp\b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe
"C:\Users\Admin\AppData\Local\Temp\b373af1dd6f071ee6457912eba286cefb45d1d970329d5e0d0f1ff704240a779.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookAW
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads