Procedure examples

JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.

KGH_SPY can collect drive information from a compromised host.

down_new has the ability to identify the system volume information of a compromised host.

Black Basta can enumerate volumes.

Attor monitors the free disk space on the system.

LitePower has the ability to list local drives.

Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

HermeticWiper can enumerate physical drives on a targeted host.

LockBit 2.0 can enumerate local drive configuration.

Zebrocy collects the serial number for the storage volume C:\.

SampleCheck5000 can create unique victim identifiers by using the compromised system’s volume ID.

REvil can identify system drive information on a compromised host.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.

AshTag can use `volumeserialnumber` to enumerate volumes.

MacMa can collect information about a compromised computer's disk sizes.

FunnyDream can enumerate all logical drives on a targeted machine.

ROADSWEEP can enumerate logical drives on targeted devices.

SysUpdate can collect a system's drive information.

InnaputRAT gathers volume drive information.

FELIXROOT collects the victim’s volume serial number.

Penquin can report the disk space of a compromised host to C2.

Cannon can gather drive information from the victim's machine.

build_downer has the ability to send system volume information to C2.

Heyoka Backdoor can enumerate drives on a compromised host.

Octopus can collect system drive and disk size information.

KillDisk retrieves the hard disk name by calling the CreateFileA to \\.\PHYSICALDRIVE0 API.

Qilin has used `GetLogicalDrives()` and `EnumResourceW()` to locate mounted drives and shares.

SoreFang can collect disk space information on victim machines by executing Systeminfo.

Pasam creates a backdoor through which remote attackers can retrieve information like free disk space.

ShadowPad has discovered system information including volume serial numbers.

INC Ransomware can discover and mount hidden drives to encrypt them.

Zox can enumerate attached drives.

SLOTHFULMEDIA has collected disk information from a victim machine.

FALLCHILL can collect information about installed disks from the victim.

SILENTTRINITY can collect information related to a compromised host, including a list of drives.

AsyncRAT can check the disk size through the values obtained with `DeviceInfo.`

CrackMapExec can enumerate the system drives and associated system name.

ZeroCleare can use the `IOCTL_DISK_GET_DRIVE_GEOMETRY_EX`, `IOCTL_DISK_GET_DRIVE_GEOMETRY`, and `IOCTL_DISK_GET_LENGTH_INFO` system calls to compute disk size.