Analysis
-
max time kernel
148s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
10-06-2023 03:28
General
-
Target
hdtune_255.exe
-
Size
627KB
-
MD5
088812a121e0a9ceb40ce9c808c8a90c
-
SHA1
08ae99e095a68036fff9bdc89229e78a6393ae6d
-
SHA256
4256abb5b5583aeb5c61937415555657a5ae3b76fcc59657edfcb3bce792f958
-
SHA512
c25caebc1bcb2b1a9be42fb6cce1aba0d7d929b53be1f50dbc4ce5c9e8b1b2b3a09affee5b683abfff4b4ae0c8fbf193ce7d69a755e1e6d7b9e6a339b6c8790b
-
SSDEEP
12288:ymkOy//gnG9b7IiVjtThhnwT4f2BQopW3FBi2xrg8lvsOqH2gOlh:yfOyXiE7Y853e+t/gOL
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hdtune_255.exe"C:\Users\Admin\AppData\Local\Temp\hdtune_255.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N8Q4A.tmp\is-0EQ7N.tmp"C:\Users\Admin\AppData\Local\Temp\is-N8Q4A.tmp\is-0EQ7N.tmp" /SL4 $9014E "C:\Users\Admin\AppData\Local\Temp\hdtune_255.exe" 406234 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\HD Tune\HDTune.exe"C:\Program Files (x86)\HD Tune\HDTune.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD5f8fc2d14df813cc920a39b3cb7e59cbc
SHA10b0bbb9d98262a745b9a404f47c1f222658d7c33
SHA256b57072eb0234ce447d30ddc18b150a831b0d63c1025dd3668befb40b29c9c573
SHA5124894567ee50584b09fa3bd653318bd4190f7ea82b60f0e370d7c08142a24177119aea79fb51ab26f5df7888168959d3b76ea1137e83619a5f35ddd4ff6342931
-
Filesize
392KB
MD5f8fc2d14df813cc920a39b3cb7e59cbc
SHA10b0bbb9d98262a745b9a404f47c1f222658d7c33
SHA256b57072eb0234ce447d30ddc18b150a831b0d63c1025dd3668befb40b29c9c573
SHA5124894567ee50584b09fa3bd653318bd4190f7ea82b60f0e370d7c08142a24177119aea79fb51ab26f5df7888168959d3b76ea1137e83619a5f35ddd4ff6342931
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd
-
Filesize
392KB
MD5f8fc2d14df813cc920a39b3cb7e59cbc
SHA10b0bbb9d98262a745b9a404f47c1f222658d7c33
SHA256b57072eb0234ce447d30ddc18b150a831b0d63c1025dd3668befb40b29c9c573
SHA5124894567ee50584b09fa3bd653318bd4190f7ea82b60f0e370d7c08142a24177119aea79fb51ab26f5df7888168959d3b76ea1137e83619a5f35ddd4ff6342931
-
Filesize
392KB
MD5f8fc2d14df813cc920a39b3cb7e59cbc
SHA10b0bbb9d98262a745b9a404f47c1f222658d7c33
SHA256b57072eb0234ce447d30ddc18b150a831b0d63c1025dd3668befb40b29c9c573
SHA5124894567ee50584b09fa3bd653318bd4190f7ea82b60f0e370d7c08142a24177119aea79fb51ab26f5df7888168959d3b76ea1137e83619a5f35ddd4ff6342931
-
Filesize
666KB
MD5cefc20d14d9940d53505e9b9769139e7
SHA1858bb656cb0dc8a790ea59882e194bacea7c9c7f
SHA25641e0a82a2e83b02fc9ee478fe22ada8609daa9c7007f8f3042f6240d6a528e0e
SHA5121ec0cd5420f0d1b20b87fef2f02c977dcde81627fa63407fca8cc46c9e87ddbc08086d8848517ccc61f7c0ce95d5225fc8a7f26166b16e5b724559a831676f95
-
Filesize
656KB
MD54fa180886ff7c0fd86a65f760ede6318
SHA12c89c271c71531362e84ddab5d3028f0756a9281
SHA2561d9026c60374b056720cdfcfa598a641cc8fbc9932590d69b4cfbc32cd09871c
SHA512a278b1d36332be9f3c284c0a4716c5e130cc6e1524c03bd693769497aeed97360c74fb8466b2d0ffd474ea8fe545c6961674ea2668a0867aee270659ad0142cd
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB