41caeb1dab6ab9da4571b88cd0a0a2b3a21ce305909358e538a04f988d4a139f

Analysis

max time kernel
454s
max time network
456s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hwid pack/usb device serial/USBDeview.exe
Size

135KB
MD5

d0d19f2cccacf70bc84846076acc11c8
SHA1

21154b5b479aaae4c56aec309bf6964eb52d1ce1
SHA256

63012ea9ce8ed335db7bdd33fa7bb449aa1ba31755c6845c1e79c11cb60dc908
SHA512

b45a024e3e22821c3a9fec56969fda164acab0f12a28a29a8c9263373004b57a246ff46f90a81b65714b09d788ed8c265de130eab059c546caae79b6d15b73d4
SSDEEP

3072:xFRB1T0ABjInqx9sKJQ1jrD0ivz0ll27ENCP7g8g3OaAy:xFRBVnj0qxbJQp/0iolGENC6RL

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

USBDeview.exe

description ioc process

File opened (read-only) \??\D: USBDeview.exe
File opened (read-only) \??\F: USBDeview.exe
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

USBDeview.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum USBDeview.exe
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 USBDeview.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

USBDeview.exe

pid process

4080 USBDeview.exe
4080 USBDeview.exe
Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

USBDeview.exe

description pid process

Token: SeLoadDriverPrivilege 4080 USBDeview.exe
Token: SeUndockPrivilege 4080 USBDeview.exe
Token: SeRestorePrivilege 4080 USBDeview.exe
Token: SeImpersonatePrivilege 4080 USBDeview.exe

description	ioc	process
File opened (read-only)	\??\D:	USBDeview.exe
File opened (read-only)	\??\F:	USBDeview.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	USBDeview.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	USBDeview.exe

pid	process
4080	USBDeview.exe
4080	USBDeview.exe

description	pid	process
Token: SeLoadDriverPrivilege	4080	USBDeview.exe
Token: SeUndockPrivilege	4080	USBDeview.exe
Token: SeRestorePrivilege	4080	USBDeview.exe
Token: SeImpersonatePrivilege	4080	USBDeview.exe

C:\Users\Admin\AppData\Local\Temp\hwid pack\usb device serial\USBDeview.exe
"C:\Users\Admin\AppData\Local\Temp\hwid pack\usb device serial\USBDeview.exe"
1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads