89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831

Analysis

max time kernel
74s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2 EURO.exe
Size 17.9MB
Sample260523-mbkhvsav7x
SHA256 89c234a7920d7e3ef70803f66162876532772624917bb45d19e8d44a48b40831
MD5 736c48673b33da5d1a23858c095a1606
SHA1 68075f86d012b6fe48dbb313347db9e5c1e88e37
SHA512 c57385de87dbcf8d75ab48b19481cc68064c1e4b4333d56aac20bf89276ec0d24bca8ae03597065da210f242c3ce35676ca17310faa3936612ad9f9c123742e3
SSDEEP 393216:4WgNdVYN1O02pJoCVs4Xhf8Kr48byGEYUV0RAx+hTKm7WM5ye:UNHAcNJtRXJRr48byGF20RQiWWW6ye
TLSH
T1BE172363F5927608B4368732CEDD54543A8AF94D6C640B5FAA07CE90B133220FD7A7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2 EURO.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5752	2 EURO.exe
Token: 33	4772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4772	AUDIODG.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5752 wrote to memory of 2300	5752	2 EURO.exe	79
PID 2300 wrote to memory of 3276	2300	cmd.exe	81
PID 5752 wrote to memory of 3128	5752	2 EURO.exe	82
PID 3128 wrote to memory of 4844	3128	cmd.exe	84
PID 5752 wrote to memory of 4984	5752	2 EURO.exe	85
PID 4984 wrote to memory of 5064	4984	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2 EURO.exe
"C:\Users\Admin\AppData\Local\Temp\2 EURO.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5752
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
    3⤵
    PID:3276
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileService" /f
    3⤵
    PID:4844
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
    3⤵
    PID:5064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5752-0-0x0000000000FE0000-0x00000000021D4000-memory.dmp

Download

memory/5752-1-0x0000000004300000-0x0000000004310000-memory.dmp

Download

memory/5752-5-0x0000000004300000-0x0000000004310000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads