152c3c9e2dbe6268d6dc6c615fdf9eb9053ae05adb2609c1be7c50e84df94fba

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
引导锁/引导锁.exe
Size 210KB
Sample260510-eav9zagy4s
SHA256 152c3c9e2dbe6268d6dc6c615fdf9eb9053ae05adb2609c1be7c50e84df94fba
MD5 eed096d4b630f1cec55ca9b3303c67e2
SHA1 b93f61965f179c8f90ee6d9d4b514ac875930a71
SHA512 cdb7b1a30a2803d272f6fbf65833b7252ba6c78bd63602193254d4ecb5c779787d6f9bff49fd777f6c2313f7b67a9d592d7de2afe1a2114661d172ce2893b8bc
SSDEEP 3072:a7x++DDhKYhmDRgiEH1/BcjoxVp5bNKsgwsv6bf871mF0jmjS9iidAkdmL4gm6ul:mHhogiY1/VVj4sgZAY7qqHFOi1tH1
TLSH
T148247D11B891D032D9B70876CCFADB7D9A2DFC410B6568D763C41EEE8E209D1BB3560A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	引导锁.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat.backup	引导锁.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\UsrClass.dat.backup	引导锁.exe
File created	C:\Windows\SysWOW64\lockmsg.txt	引导锁.exe
File created	C:\Windows\SysWOW64\recovery.bat	引导锁.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	引导锁.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4324	引导锁.exe
4324	引导锁.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4324	引导锁.exe
Token: SeTcbPrivilege	4324	引导锁.exe
Token: SeBackupPrivilege	4324	引导锁.exe
Token: SeRestorePrivilege	4324	引导锁.exe
Token: SeShutdownPrivilege	4324	引导锁.exe
Token: SeLoadDriverPrivilege	4324	引导锁.exe
Token: SeShutdownPrivilege	4324	引导锁.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4520	4324	引导锁.exe	86
PID 4324 wrote to memory of 4580	4324	引导锁.exe	87
PID 4324 wrote to memory of 4792	4324	引导锁.exe	88
PID 4324 wrote to memory of 4556	4324	引导锁.exe	89
PID 4324 wrote to memory of 4568	4324	引导锁.exe	90

C:\Users\Admin\AppData\Local\Temp\引导锁\引导锁.exe
"C:\Users\Admin\AppData\Local\Temp\引导锁\引导锁.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /create {lock} /d "Disk Lock" /application bootsector
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {lock} device partition=C:
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {lock} path \lock.bin
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /displayorder {lock} /addfirst
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /timeout 1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\recovery.bat
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

recovery.bat

Path C:\Windows\SysWOW64\recovery.bat
Size 318B
SHA256 7b23173e987f6f030158c51d47543c5dc11ad54ae47bd2fd56c7783e380e1fb0
MD5 6135bd6872ff535396b67ac27c671463
SHA1 8b0fc1761a10ba8de045eb4d6e81863573b9e4ab
SHA512 467663401aea4c45ec134a9172aca1b8dbdb450a681dd5d2c2a36bacfa2151e2d065d12e83192797e3fdebae7d5b2f86d98a451bc651a677458028870de24e8e
TLSH
T1E9E0726696A61CE2C078CDB26C02CA81EF0DE883230431CC3363FA885F3C110CC3C2A0
MD5 SHA1 SHA512 TLSH

Submit Download