Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
- Size 5.0MB
- Sample260818-dat68svbpf
- SHA256 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909
- MD5 8c02aba499e34412b520e79f2627bd4b
- SHA1 4810be4208e07495bdbe5b658a7d9dc7973e7067
- SHA512 09d082f1dc326dae4672dd7d556dc0b88ddd5ee1c8783451afb7ff44e3da432644298d15a7f51f2301ecd44f6b973c9b7261c602d8125adccf818739ecad9e06
- SSDEEP 49152:F5dKWsJv90UUmJpPRlPy+fXyzaJTmihk3UsB5Dw0LDSdly6iy9+X55ORRY55FnMZ:gvfZl6+WiYB5Dw0LDSdly6iUUm5Xr/
- TLSH T10E36C61BEAB691E4C4BAC03D9592722BFC713459873497E797859B1B0B327E0E93E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\M: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\W: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\X: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\F: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\G: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\K: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\L: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\O: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\P: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\U: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\D: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\I: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\R: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\T: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\V: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Y: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Z: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\N: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Q: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\S: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\E: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\H: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe