feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
Size 967KB
Sample260809-ehexyszcph
SHA256 feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7
MD5 e279d0e2e144eea7f96f5e23a0ad3765
SHA1 41f96f830bed9ac9c4d40ea692afeacc5f76d29d
SHA512 a90f4327c62409a1c4648219d998682e5d686ff9c7ae9df3d2cee1cb6f31c74b9e63ff08329d5e7bfda356b0f0fc8b95c35b9248cef7799a44c5d30f9c4baaf6
SSDEEP 12288:GBAMi8GG/LeIgv3LFGVOJYVBgB3DmOBvtX9W/3:GBAMLGG/LeIG38VB+Tta3
TLSH
T126255251F3F88A5CF0F36A746DB642D56A72FC20BE34CA4F6610B64E1A71950DA34B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\S:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\U:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\V:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\B:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\J:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\L:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\N:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\O:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\A:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\G:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\I:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\M:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\Z:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\K:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\P:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\T:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\W:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\X:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\Y:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\E:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\H:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
File opened (read-only)	\??\Q:	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe

Suspicious use of SetWindowsHookAW 1 IoCs

pid	Process
4228	feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe

C:\Users\Admin\AppData\Local\Temp\feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe
"C:\Users\Admin\AppData\Local\Temp\feb33bacf07d4c4e4fcb239b93ab3037d5230948b79e8c55267608003ff882d7.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookAW
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads