Overview
overview
7Static
static
3HD Tune Pr...�e.rar
windows11-21h2-x64
7App/AppInf...le.ini
windows11-21h2-x64
3App/AppInf...on.ico
windows11-21h2-x64
3App/AppInf...28.png
windows11-21h2-x64
3App/AppInf...16.png
windows11-21h2-x64
3App/AppInf...32.png
windows11-21h2-x64
3App/AppInf...fo.ini
windows11-21h2-x64
3App/Defaul...ro.reg
windows11-21h2-x64
1App/HDTune...ne.url
windows11-21h2-x64
3App/HDTune...ro.exe
windows11-21h2-x64
6App/HDTune...ro.url
windows11-21h2-x64
3App/HDTune...us.exe
windows11-21h2-x64
6App/HDTune...ro.pdf
windows11-21h2-x64
1App/HDTune...us.pdf
windows11-21h2-x64
1Data/setti...ro.reg
windows11-21h2-x64
1Data/setti...gs.ini
windows11-21h2-x64
3HDTuneProPortable.exe
windows11-21h2-x64
7$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...sh.dll
windows11-21h2-x64
1$PLUGINSDI...ce.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3Ne Ararsan...17.url
windows11-21h2-x64
1Other/Help...er.png
windows11-21h2-x64
3Other/Help...er.png
windows11-21h2-x64
3Other/Help...op.png
windows11-21h2-x64
3Other/Sour...le.ini
windows11-21h2-x64
3Other/Sour...se.txt
windows11-21h2-x64
3Other/Sour...me.txt
windows11-21h2-x64
3Analysis
-
max time kernel
240s -
max time network
203s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/05/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
HD Tune Pro Full Türkçe.rar
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
App/AppInfo/Launcher/HDTuneProPortable.ini
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
App/AppInfo/appicon.ico
Resource
win11-20240419-en
Behavioral task
behavioral4
Sample
App/AppInfo/appicon_128.png
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
App/AppInfo/appicon_16.png
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
App/AppInfo/appicon_32.png
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
App/AppInfo/appinfo.ini
Resource
win11-20240419-en
Behavioral task
behavioral8
Sample
App/DefaultData/settings/HDTunePro.reg
Resource
win11-20240419-en
Behavioral task
behavioral9
Sample
App/HDTunePro/HDTune.url
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
App/HDTunePro/HDTunePro.exe
Resource
win11-20240426-en
Behavioral task
behavioral11
Sample
App/HDTunePro/HDTunePro.url
Resource
win11-20240419-en
Behavioral task
behavioral12
Sample
App/HDTunePro/HDTuneProDriveStatus.exe
Resource
win11-20240426-en
Behavioral task
behavioral13
Sample
App/HDTunePro/hdtunepro.pdf
Resource
win11-20240426-en
Behavioral task
behavioral14
Sample
App/HDTunePro/hdtuneprodrivestatus.pdf
Resource
win11-20240426-en
Behavioral task
behavioral15
Sample
Data/settings/HDTunePro.reg
Resource
win11-20240419-en
Behavioral task
behavioral16
Sample
Data/settings/HDTuneProPortableSettings.ini
Resource
win11-20240426-en
Behavioral task
behavioral17
Sample
HDTuneProPortable.exe
Resource
win11-20240419-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win11-20240419-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240419-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/execDos.dll
Resource
win11-20240419-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win11-20240419-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/newtextreplace.dll
Resource
win11-20240426-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20240419-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/registry.dll
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
Ne Ararsanız bu sitede var--ücretsiz indir2017.url
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
Other/Help/Images/Help_Background_Footer.png
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
Other/Help/Images/Help_Background_Header.png
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
Other/Help/Images/Help_Logo_Top.png
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
Other/Source/AppNamePortable.ini
Resource
win11-20240419-en
Behavioral task
behavioral31
Sample
Other/Source/LauncherLicense.txt
Resource
win11-20240419-en
Behavioral task
behavioral32
Sample
Other/Source/Readme.txt
Resource
win11-20240419-en
General
-
Target
HDTuneProPortable.exe
-
Size
525KB
-
MD5
62c5d98777d7f5af0fbb774e979fc6c7
-
SHA1
642a495b7f310becae78ed3d1ce7d6a78982e7e1
-
SHA256
6bdea440ff56a7a4c6e637db2534f86f020d77bbe1810cc66958b9d7bbe7dee7
-
SHA512
323dd85c7a1d818c95a0298d53eb387020d762520aa2ac7b22363155378b7d7b1a6edd9e3a03aab45295794c7847117187d1ed812ef8258a5dc2f86078e3619c
-
SSDEEP
6144:hEUX/VPTSAD6RVhQ185tST+UuIg7Q+Y9Ifi+ROp5:hEgPGAAoiHUubQzIBG
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4804 HDTuneProPortable.exe 4804 HDTuneProPortable.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: HDTunePro.exe File opened (read-only) \??\D: HDTunePro.exe File opened (read-only) \??\I: HDTunePro.exe File opened (read-only) \??\H: HDTunePro.exe File opened (read-only) \??\S: HDTunePro.exe File opened (read-only) \??\N: HDTunePro.exe File opened (read-only) \??\R: HDTunePro.exe File opened (read-only) \??\G: HDTunePro.exe File opened (read-only) \??\K: HDTunePro.exe File opened (read-only) \??\M: HDTunePro.exe File opened (read-only) \??\E: HDTunePro.exe File opened (read-only) \??\J: HDTunePro.exe File opened (read-only) \??\Q: HDTunePro.exe File opened (read-only) \??\O: HDTunePro.exe File opened (read-only) \??\T: HDTunePro.exe File opened (read-only) \??\W: HDTunePro.exe File opened (read-only) \??\X: HDTunePro.exe File opened (read-only) \??\P: HDTunePro.exe File opened (read-only) \??\U: HDTunePro.exe File opened (read-only) \??\V: HDTunePro.exe File opened (read-only) \??\F: HDTunePro.exe File opened (read-only) \??\L: HDTunePro.exe File opened (read-only) \??\Z: HDTunePro.exe File opened (read-only) \??\A: HDTunePro.exe File opened (read-only) \??\Y: HDTunePro.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 HDTunePro.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4804 HDTuneProPortable.exe 4804 HDTuneProPortable.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe 4548 HDTunePro.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4804 wrote to memory of 4548 4804 HDTuneProPortable.exe 80 PID 4804 wrote to memory of 4548 4804 HDTuneProPortable.exe 80 PID 4804 wrote to memory of 4548 4804 HDTuneProPortable.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\HDTuneProPortable.exe"C:\Users\Admin\AppData\Local\Temp\HDTuneProPortable.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\App\HDTunePro\HDTunePro.exe"C:\Users\Admin\AppData\Local\Temp\App\HDTunePro\HDTunePro.exe"2⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
624B
MD599698f530ee6ee494895b7f1b5965baa
SHA1049f5e78f23c8bccc6ca331ce72056132237a53b
SHA256ca81c95d231774e029ec6e166d1e6c2bfc7761dc86f30b8bf80c8df7ff799b72
SHA512506debd024d2bdb08692cfd381625153e6c1ec7d5ca0917ab5119ef1b0e4a3a5024f8c75ff2d55c188109bec23f90f5ba3372d0ddba93dc20d34f2f9fd66a2c6
-
Filesize
29KB
MD52880bf3bbbc8dcaeb4367df8a30f01a8
SHA1cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SHA256acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
SHA512ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3