Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe
- Size 5.0MB
- Sample260818-dat68svbpf
- SHA256 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909
- MD5 8c02aba499e34412b520e79f2627bd4b
- SHA1 4810be4208e07495bdbe5b658a7d9dc7973e7067
- SHA512 09d082f1dc326dae4672dd7d556dc0b88ddd5ee1c8783451afb7ff44e3da432644298d15a7f51f2301ecd44f6b973c9b7261c602d8125adccf818739ecad9e06
- SSDEEP 49152:F5dKWsJv90UUmJpPRlPy+fXyzaJTmihk3UsB5Dw0LDSdly6iy9+X55ORRY55FnMZ:gvfZl6+WiYB5Dw0LDSdly6iUUm5Xr/
- TLSH T10E36C61BEAB691E4C4BAC03D9592722BFC713459873497E797859B1B0B327E0E93E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\U: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\V: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\W: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\D: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\E: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\O: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Z: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\H: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\K: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\R: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\X: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Y: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\F: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\I: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\J: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\M: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\N: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\Q: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\G: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\L: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\P: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe File opened (read-only) \??\S: 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000059e6eec40365f0360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380159e6eec40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410159e6eec4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e359e6eec400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e659e6eec400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr 2e72822b370662e21a596db88e181c147e310cfb602dbc0998abb8ce7faeb909.exe