89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831

Analysis

max time kernel
74s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2 EURO.exe
Size 17.9MB
Sample260523-mbkhvsav7x
SHA256 89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831
MD5 736c48673b33da5d1a23858c095a1606
SHA1 68075f86d012b6fe48dbb313347db9e5c1e88e37
SHA512 c57385de87dbcf8d75ab48b19481cc68064c1e4b4333d56aac20bf89276ec0d24bca8ae03597065da210f242c3ce35676ca17310faa3936612ad9f9c123742e3
SSDEEP 393216:4WgNdVYN1O02pJoCVs4Xhf8Kr48byGEYUV0RAx+hTKm7WM5ye:UNHAcNJtRXJRr48byGF20RQiWWW6ye
TLSH
T1BE172363F5927608B4368732CEDD54543A8AF94D6C640B5FAA07CE90B133220FD7A7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2 EURO.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	2 EURO.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1632	956	2 EURO.exe	88
PID 1632 wrote to memory of 1172	1632	cmd.exe	90
PID 956 wrote to memory of 3856	956	2 EURO.exe	91
PID 3856 wrote to memory of 4064	3856	cmd.exe	93
PID 956 wrote to memory of 4132	956	2 EURO.exe	94
PID 4132 wrote to memory of 3816	4132	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\2 EURO.exe
"C:\Users\Admin\AppData\Local\Temp\2 EURO.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
    3⤵
    PID:1172
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService" /f
    3⤵
    PID:4064
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
    3⤵
    PID:3816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x514
1⤵
PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-0-0x00000000001A0000-0x0000000001394000-memory.dmp

Download

memory/956-1-0x000000001BFE0000-0x000000001BFF0000-memory.dmp

Download

memory/956-5-0x000000001BFE0000-0x000000001BFF0000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads