Analysis
-
max time kernel
884s -
max time network
442s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
08/07/2024, 05:59
General
-
Target
DiskGenius v5.6.0.1565 x64 Eng.exe
-
Size
29.6MB
-
MD5
bc35ebf394978caf51353f35b6640a6d
-
SHA1
a954b8c3dea73c2b10df9508a02a45e528d53aeb
-
SHA256
59c37c627e60326408c64eeb836bd28fffc5ffd8e888e8219e3a51ca84bcda34
-
SHA512
f1d9a1251d6438d04f6968e79444175647d5eee6e3914d2af9755a8ad83378b9ee5d405fd3520a40d03cc6db4c2ecce6ca351953732523b5c045444e9bd8781a
-
SSDEEP
786432:7yTP5RS4UMlA5+8eTMuNobUVHmUvi4nDIcf5:7YkMlAre9NZvive
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiskGenius v5.6.0.1565 x64 Eng.exe"C:\Users\Admin\AppData\Local\Temp\DiskGenius v5.6.0.1565 x64 Eng.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskGenius\DiskGenius.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DiskGenius\DiskGenius.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27.7MB
MD5db0ba056da9adea8e8e29ff01b19b006
SHA18c10a18881a7989ba43ec8687888365e140b4cb7
SHA2566d4e0905d1869b754d43a486b79f57d128d8fb9a48482807b90f2e656960d429
SHA5126a1a211bd6680348f2a4ac99bf2df9549fb9de3bb34fb0e73c11a36f84de93f697996e2b20d4eefd239fcf09510b21aed18c9c7045b8b69e5c137e68d81f0dcf
-
Filesize
7KB
MD5159aa9ac5776847a4d92afa9744f768d
SHA148d03513f8520ac2e2b7f415f31b533b50031599
SHA2567212b12cb35bffa2314345bb1e2fa12f47dff15616de3de63612501f7ac0761d
SHA512ec90beb78cbff0caf5597815f309ebff83e06b565dab0c0216458fc50b169ce53741fe6afb982dde59fe0c8d2d16c7b3c976349c27a61ef8845a139d5de7bee5
-
Filesize
381B
MD547f15bc6d8c718911f6a9995e7d25e42
SHA19bc571ae6fb1a9e6cae08a5795555e88cf7ee06c
SHA25634d56812604cd08049b31c3e14767c744972f26196d0c09e15c86b59710d8be3
SHA5125592cc6d18a9b1b0e96f6c2107db05577e671e6df09054f36fb70b6c3ad32d57e8e1a6b631b5bc23c8a0e54be0fc43e990029571ee6da88440c620b4f838d4d8
-
Filesize
12KB
-
Filesize
24KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
50.0MB
-
Filesize
12KB
-
Filesize
24KB