Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1792s -
max time network
1178s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/03/2024, 09:34
General
-
Target
Hetman Partition Recovery.exe
-
Size
15.7MB
-
MD5
1c88d4194868605036a1c63ef87cdad3
-
SHA1
71a723093d81fcd23ded28e31ee47dad9e284441
-
SHA256
d86133a7e9808b59de7329d4c67f4038dadbad23720ec23356f0461b29eab974
-
SHA512
ec6c8a380d2f39a1f647801d5dc3bb892d5f0230e3455768cdc40c010da7db1eedc944f1564e35d6d5a922ad44d146d5738ae456bd01a23dc7369620ba9aae9e
-
SSDEEP
393216:W9IWamrUKKGjKP0QJKPnflVR3BZExnS3/3c:LWGdGWRKvfHR3BZExnUM
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hetman Partition Recovery.exe"C:\Users\Admin\AppData\Local\Temp\Hetman Partition Recovery.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
-
Filesize
4KB
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.3MB
-
Filesize
3.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB