Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/11/2026, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe
- Size 1.1MB
- Sample261107-tyf8aads51
- SHA256 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0
- MD5 c9dc60dc03a86a75661648ce098749af
- SHA1 4962ad518f10fd33d0705a5cc832222c304180cd
- SHA512 55f86587e53689f23da1a610ba83c27bd0e36fc62a716456906f092cde278e014e0a65cacf9b552b6857a9f7b15f089358ce5fd32e18d2eb37ea9fc037df8472
- SSDEEP 24576:VzlkVX0Sg8tOtL1tdHr0SqUpppp+wiVkPnvggY0c:Vz6VX0Sg8tOtJtdHVbs
- TLSH T158352B13E2E60198E1B7F6748AB566319537BC544934EA5E138CCA6A1F63F80CE39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\Y: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\D: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\F: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\K: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\S: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\X: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\B: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\G: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\I: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\J: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\O: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\T: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\U: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\V: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\H: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\L: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\M: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\P: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\R: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\Z: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\A: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\E: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\N: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\Q: a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 64 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PhysicalDrive30 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive50 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive0 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive16 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive26 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive36 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive45 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive53 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive55 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive61 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive11 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive18 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive22 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive51 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive58 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive4 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive8 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive9 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive20 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive40 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive6 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive10 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive25 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive48 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive3 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive14 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive31 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive43 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive29 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive33 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive42 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive47 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive52 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive1 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive37 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive62 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive63 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive38 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive39 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive2 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive19 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive34 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive41 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive54 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive12 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive15 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive17 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive13 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive27 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive28 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive32 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive59 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive5 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive7 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive21 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive23 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive24 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive56 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive57 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive35 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive44 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive46 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive49 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe File opened (read-only) \??\PhysicalDrive60 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 2776 a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe"C:\Users\Admin\AppData\Local\Temp\a0337536ef005b35e4be46382fb4c34eb6c37c0231e72d02d0b91e8dbd0421a0.exe"1⤵
- Enumerates connected drives
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
PID:2776