Procedure examples

Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.

ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.

A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.

BLINDINGCAN has collected disk information, including type and free space available.

Ninja can obtain information on physical drives from targeted hosts.

Proxysvc collects volume information for all drives on the system.

Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.

NOKKI can gather information on drives on the victim’s machine.

yty gathers the the serial number of the main disk volume.

KOPILUWAK can discover logical drive information on compromised hosts.

Sardonic has the ability to collect the C:\ drive serial number from a compromised machine.

KEYMARBLE has the capability to collect information on disk devices.

Bankshot gathers disk type and disk free space.

SharpDisco can use a plugin to enumerate system drives.

StrongPity can identify the hard disk volume serial number on a compromised host.

Nebulae can discover logical drive information including the drive type, free space, and volume information.

TONESHELL has retrieved the disk serial number of the device using WMI query `SELECT volumeserialnumber FROM win32_logicaldisk where Name =’C:` to identify the victim machine.

Medusa Ransomware has enumerated logical drives on infected hosts.

macOS.OSAMiner has checked to ensure there is enough disk space using the Unix utility `df`.

Aria-body has the ability to identify disk information on a compromised host.

Crimson contains a command to collect disk drive information.

DynoWiper has used the Microsoft Windows native `GetLogicalDrives()` and `GetDriveType()` functions to enumerate all the drives visible to the system.

Avenger has the ability to identify the host volume ID.

PUBLOAD has leveraged `wmic logicaldisk get` to map local network drives.

Woody RAT can retrieve information about storage drives from an infected machine.

Mafalda can enumerate all drives on a compromised host.

MoonWind can obtain the number of drives on the victim machine.

HOPLIGHT has been observed collecting victim machine volume information.

InvisiMole can gather information on the mapped drives and system volume serial number.

WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

BlackCat can enumerate local drives.

Nightdoor can collect information about disk drives, their total and free space, and file system type.

Kazuar gathers information on local drives.

Rising Sun can detect drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.

Chrommme has the ability to list drives.

HELLOKITTY can enumerate logical drives on a target system.

CORESHELL collects the volume serial number from the victim and sends the information to its C2 server.

RunningRAT gathers logical drives information and volume information.

Babuk can enumerate disk volumes, get disk information, and query service status.

BlackMould can enumerate local drives on a compromised host.

PlugX has collected a list of all mapped drives on the infected host.

Reaver collects volume serial number from the victim.

Epic collects disk space information.

Cuba can enumerate local drives, disk type, and disk free space.

DEATHRANSOM can enumerate logical drives on a target system.

DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.

Mongall can identify drives on compromised hosts.

LockBit 3.0 can enumerate local drive configuration.

TYPEFRAME can gather the disk volume information.

TAINTEDSCRIBE can use DriveList to retrieve drive information.