Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
-
submitted
06-08-2022 03:42
General
-
Target
BLTools 1.9 [CRACKED BY INJUAN]/BLTools-v1.9.exe
-
Size
9.3MB
-
MD5
5b8fee9267593396b57d345a9afc7ddb
-
SHA1
264968d1bf7c1f6ad0ca4cbdeb89762ddd294948
-
SHA256
90dc5d6d2a6b8b4dc6b5f95c44d24b1b6e1916911b1b7a51dd97ed055156fddd
-
SHA512
69f9254f78f6ba09d456321cdc74dd74115debc5b91d4abf00cbf665d91ace2d1f4289ee0be9aa32a437b3d14d420b149e778a244c1478df59f3bc9a9571f085
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 5 IoCs
-
Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools-v1.9.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools-v1.9.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools v1.9.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools v1.9.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 17164⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools-v1.9.exe"C:\Users\Admin\AppData\Local\Temp\BLTools 1.9 [CRACKED BY INJUAN]\BLTools-v1.9.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
Filesize
5.1MB
MD5f36d71183fe68a91e94b2f6608700007
SHA1e0c9afb2309e1d00dbb292a61c95feabee0ca1e5
SHA256539301d8f1e30accc6f993a8c9bf3dc79196f864ef4455e07de6cdd46a17c305
SHA5126a25d645f9247e5eea60de4a7e07b661d018cdb1eb2b7f92800124f4362351cc6dd9400fad596bcbcdfba9273037ba9c62fb61a4dfaafb50155b081b98dc84bd
-
-
Filesize
4.9MB
-
Filesize
13.6MB
-
Filesize
8KB
-
Filesize
13.6MB
-
Filesize
24KB
-
Filesize
7.5MB
-
Filesize
13.6MB
-
Filesize
13.6MB
-
Filesize
68KB
-
Filesize
8KB
-
Filesize
384KB
-
Filesize
144KB
-
Filesize
5.1MB
-
Filesize
40KB
-
-
Filesize
12.8MB
-
Filesize
3.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-