Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25/09/2024, 15:03 UTC
General
-
Target
HD_Tune_Pro_v5.00.exe
-
Size
7.5MB
-
MD5
14a93cf0f4e1c3239336990f90f18362
-
SHA1
88bb17f887556e669f721769cbbfac5d5580e60d
-
SHA256
8c44c173870c5cdc938e7e13fe92b5a813306368bc331a72a04dcc47a0f77a8a
-
SHA512
24cb9eacf4b5ff2b92b418e23707f261fde9a8a38d77ded3b89e565357720f7b78f32c982209f0e1d4f02736b25b25a58a7e6b3347a0a91d299cb51457a0f210
-
SSDEEP
98304:B8fgSSdjQelz0XWy3HBKpyhDTOQulLmx5tYIFasOtulKllQ06JBRJU6+HHqIBqUg:yfqDqWy3hZ91AIFasOgMllx6JBXU6vGu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HD_Tune_Pro_v5.00.exe"C:\Users\Admin\AppData\Local\Temp\HD_Tune_Pro_v5.00.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\VOS\HD Tune Pro\%Program Files (x86)%\HD Tune Pro\HDTunePro.exe"C:\Users\Admin\AppData\Roaming\VOS\HD Tune Pro\%Program Files (x86)%\HD Tune Pro\HDTunePro.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS83.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
DNS83.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTR
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTR
-
DNS73.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS107.12.20.2.in-addr.arpaRemote address:8.8.8.8:53Request107.12.20.2.in-addr.arpaIN PTRResponse107.12.20.2.in-addr.arpaIN PTRa2-20-12-107deploystaticakamaitechnologiescom
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5383.210.23.2.in-addr.arpadns
DNS Request
83.210.23.2.in-addr.arpa
DNS Request
83.210.23.2.in-addr.arpa
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:5373.159.190.20.in-addr.arpadns
DNS Request
73.159.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:53107.12.20.2.in-addr.arpadns
DNS Request
107.12.20.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD5b8136653535808a925a576e83d6f932a
SHA128bd657086e0d7532f3723512f54ff9f5ca49bde
SHA2561b3a290b8cca881d10dfc2b87ef82b2dac7b0060e7ed92f035c8401d4a02c57a
SHA51224b94add8fae2ac8985b6ea62121668c33f50f358852d59e8d83ff7eb6d675b02c7cf3495b212dd6a6f0797cc1389f9a4500aee65bfe321e109666620cada6fc
-
Filesize
572KB
MD53007d95d7b00061dd72f2bc291e28770
SHA16e95093fa99d185bb5c7d12f22bf7d7ce94add2d
SHA256efe2d2a6fa61e96faae789337daf40346b825d9b9c49c1dcec67bd5abc9b4cf6
SHA512dff9ef99a56562d102d9748b18efee69e7afeb293d6734094d99f1569dd4ff9fb8a353c55cc1cb51e0185fc6faea6f25c2104b49de818ba4cdc8b64a21c0e2d3
-
Filesize
14KB
MD5154977c2d1acf2e48c82f9969ce3d397
SHA1556d4898d0a7cc10d7e30e2b912d379bfd317f70
SHA25681ef6cbd8c20e4b42eb56afbd365d183a05cc4dee8da5d992706ddbfa558bbb0
SHA5120e03269ec9d6e78ac98841fd5b7b64020a2d1390ef56a038161bbcee83d8945c6039b2e0af7c854c7a3bffe2ce559dffcb4ca5c6c89309b0b6396168d34defbb
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
920KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
920KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
920KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB