Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 13:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe
- Size 8.0MB
- Sample261107-qqknyscs61
- SHA256 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb
- MD5 90bb45132b0249c0b18dd7bf9a5a3396
- SHA1 e1234160d55cd7facb37c6c6106c7e9c9a5662eb
- SHA512 3ca0f38319f46d7c1414ee809318abdab2944c5661d468c1f27d2bac237d458f9c5b6a8030df78bccbd13056bb0a41b27612c122926cff3c60d6908d500dee8f
- SSDEEP 196608:ymt+tNDqXyDkXzvSHImowgno5h/BImoYpOl/DDZ7br:yamoNJmyl/DDVb
- TLSH T11F86D007D2A352ECC077D57586AAB233A5317C4C4834BA6E6B90DF352F21FA0D62DB19
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\R: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\U: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\D: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\K: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\O: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\X: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\Y: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\Z: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\G: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\I: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\S: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\T: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\V: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\W: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\E: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\M: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\Q: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\F: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\H: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\J: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\L: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\N: ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 64 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive0 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive16 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive28 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive59 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive15 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive39 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive58 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive12 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive21 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive40 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive41 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive61 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive19 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive22 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive35 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive10 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive20 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive23 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive63 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive47 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive55 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive27 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive3 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive5 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive6 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive8 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive24 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive33 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive25 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive49 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive52 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive53 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive56 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive62 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive26 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive34 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive38 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive37 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive42 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive48 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive51 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive11 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive4 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive18 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive36 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive46 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive50 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive7 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive14 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive54 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive13 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive9 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive31 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive57 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive2 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive29 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive32 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive43 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive45 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive60 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive1 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive17 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive30 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe File opened (read-only) \??\PhysicalDrive44 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4100 ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe"C:\Users\Admin\AppData\Local\Temp\ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.exe"1⤵
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ff2dff82aa39f5d56bef41a99bb8118145c7f2bb9e0325c0fa089e39312772eb.INI
- Size 19B
- SHA256 d4920818e69449b8a14a23f62d29542f8c59cc8085915c5604045b297dd1d684
- MD5 c245f1e23bf24481ded7b44eff75c83b
- SHA1 0087512b7ac7d341a3bdf25465b98b5f26978caa
- SHA512 cbe2ae95f4d79b77d59affd63c145c4b5cd2a5702d3ccdcdf0eaa448f8237498fa9bf2379bba780053fb9dc61e2486910b45daaf2e29fb7d1723d97079fe262a
- MD5 SHA1 SHA512