975899601e22dacaf46f6de2ba08cc7747f908c76cd5fe0af885872e73fd4f8b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hdtunepro/hdtunepro/HD.Tune.Pro.5.60.温度乱码修复 (简中).exe
Size

61KB
MD5

e78951c64dbe8fab29454f4158963a0b
SHA1

8c5127558d00ad9f30d14c9fb7c7adaf665a7a6c
SHA256

2e21e905e6361989796d644b71b10df269abf630bd550de4f3d55046b4721b64
SHA512

2fedbf04c74320ef6ee540b524ced3c340947d6c25eae7fa73478a4ce4c9e56374a29f8e30e149c2e3b2b26b06094c5d9bc97dbe971df3900c5a373b935315c4
SSDEEP

1536:V2RlHeYl8wj/ZRm5xuK94kc/sU1aObB9qUj64bEz95cFu:VglHeGvDnuxgkc/sU1jn9u4be5cF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3040	HD.Tune.Pro.5.60.温度乱码修复 (简中).exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD.Tune.Pro.5.60.温度乱码修复 (简中).exe

C:\Users\Admin\AppData\Local\Temp\hdtunepro\hdtunepro\HD.Tune.Pro.5.60.温度乱码修复 (简中).exe
"C:\Users\Admin\AppData\Local\Temp\hdtunepro\hdtunepro\HD.Tune.Pro.5.60.温度乱码修复 (简中).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dup2patcher.dll

Filesize
55KB

MD5
9b098531ef3f33d3fbf14972e83239a0

SHA1
221795bf568d47e2133e75db221f468daa12af3b

SHA256
6ed2efb98ed454bf8f5018c22603afbd68693936435a09c77e8768829d60c598

SHA512
0cd8d34155f15966617957fe556127016ce20c1544cdbece2c339d13b50f44d386363e937c0e44738b4761c91862a3602ca5b150d12ff7e79c9d3df0976bfe27

Download Submit
memory/3040-3-0x0000000075310000-0x0000000075336000-memory.dmp

Filesize
152KB

Download
memory/3040-4-0x0000000075310000-0x0000000075336000-memory.dmp

Filesize
152KB

Download