Analysis
-
max time kernel
138s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15/03/2024, 02:25
General
-
Target
hdtunepro_575_full.exe
-
Size
2.1MB
-
MD5
a207d678f860bd32a645fc8dd5fe9052
-
SHA1
17017f6f4d5c96ff028462091c969a2e863aa01f
-
SHA256
97bea818fcd2d8bf7191901784efccc70f15b888748196166fe2779008fe5663
-
SHA512
c554a26b0df70932305f74c3755aad030fd6e9504037a44721cb2e0aba73a093d91aba28c75e88888115d4cdd19f1ba361871943420174b5f7948ce4f4f34615
-
SSDEEP
49152:5aWkOfAI8VQyJ8FRQ3Reu7+iQmArGLhTM5DjEF2UTO9g4FY:QrOfALVQyJKMMgUGLK5rN8
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hdtunepro_575_full.exe"C:\Users\Admin\AppData\Local\Temp\hdtunepro_575_full.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BFR9J.tmp\hdtunepro_575_full.tmp"C:\Users\Admin\AppData\Local\Temp\is-BFR9J.tmp\hdtunepro_575_full.tmp" /SL5="$4010A,2007759,54272,C:\Users\Admin\AppData\Local\Temp\hdtunepro_575_full.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\HD Tune Pro\HDTunePro.exe"C:\Program Files (x86)\HD Tune Pro\HDTunePro.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57cc7323e674674ac819460b7923ba1d3
SHA1326f440849d99c58e4d7443bcc4dbae9bcc6604c
SHA2560dbe7542b65692e024a68f7fbadb9d93b986f75d445984d446b76b2599f5986e
SHA512f58b2c9104bde00337460f2db946ed49c48d490e5a87d463815c8e65e9db69443e956a806c070f0e88fe237d220fd0136d01aa516365481fb6771d60de505153
-
Filesize
964KB
MD58f139acc290573f531accb47edd3d41c
SHA1cab9587c3eec14b8b6bb713656eec3c443abf81d
SHA2564d7861b5b3fee41be2c3347a6b9a827aa3f65151df12bc47125e82a204bfb2cb
SHA5124de5d6b45c7c30b9419b092e964468e51b0d85f6e819797bf078ddf5b099b5cea9957914b6fbca8e7ba05f2123096eb0448ff91c85c7b4fab1abaaccab661b7b
-
Filesize
697KB
MD563abc2e67a080888aea74e47c07fa345
SHA1d01a98f161f196112506cc2d494233a64f4b1ae6
SHA2563532b10c54cdfa5499cad3ef427fd74c7967444924396f9f521b827a0769a328
SHA51228a0852802a9e400ec0b22835fc268aa4bd87b4dcca49018523ae5a716e66fe0d2c25211f86c0eba42fc043e723c8c5a87b32c33aa809aa89471bbaeb7b7f18f
-
Filesize
687KB
MD5c080f73b1bdde0853cb0258d9a02b0ec
SHA1a5112a53e6e75069ac06b7bbd658f7cf2c8f2dee
SHA256a0cfbc8da39ad4a4d21c61d73873d225ffa5d7650fae5938ab643f719d5f7363
SHA512e514be3f983de22c0f67bac318686b7fe75cb6fd9832f3603077ad25c559155b7df71555b92bb6366835a104c8d2828cec2766fb7f855bd3f79f66319d6a5eac
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB