447b5760863694ffaa9e6a32eb365f8313573faa5bef285d7dac1ee805a02031

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2,3,7,8-Tetrachlorodibenzodioxin.exe
Size 553KB
Sample260523-mbkhvsav7x
SHA256 447b5760863694ffaa9e6a32eb365f8313573faa5bef285d7dac1ee805a02031
MD5 c348fc5bdc33f3dd46eadd224a424923
SHA1 a4707d6a73e9de26463cd8e39eaa156aadd4727b
SHA512 8b3ed1235e281db7981a332191bf6ac3ef7b6404345b97af00f3ef5009c24b393b4ebba5f7a25486304d36baf91d1e2cce91188ea8e740476e113d27d31d10cd
SSDEEP 12288:L0LN8WMCeEbmtQ6LmL1KscF0Lflr2UploeQJtbOPPNzPnDgzlnZ2CyZGW:C8WjXcF29bmbbOP9gzlZns
TLSH
T152C419F3A4C133D1EC7184B6820795B19587BD36D6C16DFB10E9727A0B6B443826BE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2,3,7,8-Tetrachlorodibenzodioxin.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2,3,7,8-Tetrachlorodibenzodioxin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2424	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3572	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3424	2404	2,3,7,8-Tetrachlorodibenzodioxin.exe	98
PID 3424 wrote to memory of 2424	3424	cmd.exe	100
PID 2404 wrote to memory of 1800	2404	2,3,7,8-Tetrachlorodibenzodioxin.exe	101
PID 1800 wrote to memory of 3572	1800	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2,3,7,8-Tetrachlorodibenzodioxin.exe
"C:\Users\Admin\AppData\Local\Temp\2,3,7,8-Tetrachlorodibenzodioxin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4a0
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads