Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 10:55
General
-
Target
$TEMP/{tmp}/HDTunePro.exe
-
Size
718KB
-
MD5
a89e2c78e6dad4b81e8a1884c1e95716
-
SHA1
813f3c1711ad8cb2f4ea7ab62a1c26d4c744cd74
-
SHA256
acc68f63823435d26d17724ef073e6941eaebc5c7f80edc04b2063c619c510af
-
SHA512
c4446e0bbecf073921fda2c48ae8b1cab7e9f1549b4fdbcc4a2e70e5c2a50cf09a4f439831a9f1333e8c96a8a650772fbde8676c0e88e24a9bf53e64d6c67a88
-
SSDEEP
6144:A7x+nfVHUXyuo4Fa8Wb3fykKAPdZhDQ8+V6IEx4mWmkuIwtST+TVPTSAD6RVhQ1M:8xwVC9U9b3fyLWYVZEFdkuxpPGAAoiT
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\{tmp}\HDTunePro.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\{tmp}\HDTunePro.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB