a757b249c182a28926811d28565b54029bf245c8f3f0032e01f85073f8acf0bc

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef_commander_64/EFCW.exe
Size 9.5MB
Sample260825-cskvvawcne
SHA256 a757b249c182a28926811d28565b54029bf245c8f3f0032e01f85073f8acf0bc
MD5 2fbf7389c08e637f0007d7ee04bd3c86
SHA1 1527d9396bf52a1a505d4fa079d233341bab9ff3
SHA512 df912d48efc126872f583e9be720b4cf53d155c24485703d6c278359cb066e5649bcbe648c2f5a2eb2266f78e4f8692e7db45816e64b5a580cf192f103ddeb4e
SSDEEP 196608:Xo9i2UX5ON3f1TSlblt6LkCGy6dA7KRirp:XyicpNOy6dA7Ksp
TLSH
T1A1A65D46F7A2D0D9C076C038C4429226F6713D556B328BEF66487F6AAF327E35939342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	EFCW.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5800	EFCW.exe

C:\Users\Admin\AppData\Local\Temp\ef_commander_64\EFCW.exe
"C:\Users\Admin\AppData\Local\Temp\ef_commander_64\EFCW.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads