Analysis
-
max time kernel
140s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
05/10/2024, 07:47
General
-
Target
Hfolder/Hfolder.exe
-
Size
1.2MB
-
MD5
4aa093d03ac449134ee5fbc4d02ec805
-
SHA1
8edececa12d46ed6729f122b218ade6d5c677b5a
-
SHA256
9738641285a96d7b72ed98e1ff0d93217d49a74c1e54d2d08252e00afec7d059
-
SHA512
70588cdd13471b95371773df2244d98f4c644a6eb8f65a8e2baf830f5336b76402843973727b07694b9c8ab29083360585ca4fa02f8d02a94293a5b3bb6dfb25
-
SSDEEP
24576:v3g62vnKTHHmn/1Rz+M0BioHkscvi2lLgMcB01fuUhsUl21Vk:I6inKjmPN6itscK2lx7hsWUVk
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hfolder\Hfolder.exe"C:\Users\Admin\AppData\Local\Temp\Hfolder\Hfolder.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c323e69530f338ad6e6877e1729fb01c
SHA15d0c81fe27b8574f418e1d45165ebec698cb7873
SHA25684cedc15a8f1a2ca2a633a497cd9f7764e09728b1119d4635b7aa7fb058d2770
SHA512d7b8cf8ad6dd00f624779d878ba3334f1a5762a3a49be4fb973232f0d0bd299258001d9502158a93913fec8950850f17cf4d6e6814ab0d11e653e2e473b1b7f7
-
Filesize
2KB
MD584bcbaa308beebd413ef963dcc68fec8
SHA1347b9b2a8cdc80993c71bca2f3299324a7dc58ab
SHA25670a406dee00412bac45487c5570863dd3a8f7561c89599912eb255f9fb4dad5f
SHA512d68f92b95f4e6be243ebe0240f347300f21feb2b25b627b4227306ca1098ab906016e1af6314db34908c9a9471828017ddc38984426131b921ae546dd521993a
-
Filesize
2KB
MD56377799c01f8806313e3b56a1fb1a362
SHA1cc695913a1d18286d8f9af095f595a97361497ac
SHA25607ae7990b7fa7353f19c20bc65bf64f863837630966980e16cb107a7210359a6
SHA51268a7085f43af512c42e7abb9226d4fc7604d4b27994d93c9d990ad5a7fc7ec96ff41ea6f30485f52a71730d41a167371c82c3cab1c5febfd75163905bb18c1fa
-
Filesize
2KB
MD574187b36b3e0b6cc3baef521a6cfd886
SHA16041195118d88fc361eb16da3a45f78f5dc0afcf
SHA2561bf5e48c72c95cff731468ab64557bd3a71ca032b83acce95ea5ba92ec4a2171
SHA512685f45995ff435d4e670b3b5772ec9b39460446196b29462f108ac6a16e9f9868248da2e6063593ab7aab4bfb626233e66db0bfebee28f673552d534de9affe6
-
Filesize
2KB
MD567fc7843c3110e526e9f5cb89dee8964
SHA1f92d33c60f71c48c944dc68dbf225f8ea3f07450
SHA256b91dacba690ca33d0546c08b7b3053085cb402b15f039f9f4a2cb208b890780c
SHA512f2c96d2a6550cad3acf0bad0199ff6b728222ea20bd1ee998b11543e8e9dc79b0b4a736e902f95e8969b9366f3361dcf267240fa8f8733d67460245c9a5c8f66
-
Filesize
2KB
MD5ffd9f537ed1e5c03068eec32ab2ea826
SHA1417be03c847605f47afc9371cb3ee675f40dc241
SHA256b9872fcd0d9a19e94fbbc09b30b5bc792d26861740e82d9ad711508dbbc0b140
SHA512eecc798cf1682dcb2448f8bb3d66cdb059112d1bed69a1b537c31671b96b548049ef3b0978228000caeeb13c0bec1e13caa335154a066d9c949ff839089ef41d
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
892KB
-
Filesize
276KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
276KB
-
Filesize
276KB
-
Filesize
1.1MB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
892KB
-
Filesize
272KB
-
Filesize
1.1MB
-
Filesize
892KB
-
Filesize
8KB
-
Filesize
892KB
-
Filesize
1.1MB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
892KB
-
Filesize
8KB
-
Filesize
392KB
-
Filesize
892KB
-
Filesize
276KB
-
Filesize
392KB
-
Filesize
136KB
-
Filesize
272KB
-
Filesize
1.1MB
-
Filesize
1.1MB