Analysis
-
max time kernel
298s -
max time network
315s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-02-2023 10:14
Static task
static1
Behavioral task
behavioral1
Sample
blender-3.4.1-windows-x64.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
blender-3.4.1-windows-x64.exe
Resource
win10v2004-20220812-en
General
-
Target
blender-3.4.1-windows-x64.exe
-
Size
683.8MB
-
MD5
aedf8960317a0effcd89c5d816137067
-
SHA1
4e074a8e180a9d3248f5fceadf28ea4f7146b33e
-
SHA256
eeaaa0e20ba43f13e0b62862979abe7f50bb558a812fc4aa729e946fdbe54e98
-
SHA512
f1e7d861e01ebcc69cad9cceee712885ef1739a84923787bfe7d9e5e9e108b2721b2a1e916e4a33fa947ac84ed6010c1d32fdf0091b3a9ca7f34738a6be6981a
-
SSDEEP
3072:mcqqdOyJocZB0O7i4Cg3DILI48p8ERDuwBbEUA:T/dOyJovrg3/ppDuwBYU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
blender-3.4.1-windows-x64.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Tqhtsdgnsm\\Vcelkcpar.exe\"," blender-3.4.1-windows-x64.exe -
Processes:
InstallUtil.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" InstallUtil.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
blender-3.4.1-windows-x64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation blender-3.4.1-windows-x64.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 eth0.me -
Suspicious use of SetThreadContext 1 IoCs
Processes:
blender-3.4.1-windows-x64.exedescription pid process target process PID 5060 set thread context of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3536 powershell.exe 3536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
blender-3.4.1-windows-x64.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 5060 blender-3.4.1-windows-x64.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 456 InstallUtil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
blender-3.4.1-windows-x64.execmd.exedescription pid process target process PID 5060 wrote to memory of 3884 5060 blender-3.4.1-windows-x64.exe cmd.exe PID 5060 wrote to memory of 3884 5060 blender-3.4.1-windows-x64.exe cmd.exe PID 5060 wrote to memory of 3884 5060 blender-3.4.1-windows-x64.exe cmd.exe PID 3884 wrote to memory of 3536 3884 cmd.exe powershell.exe PID 3884 wrote to memory of 3536 3884 cmd.exe powershell.exe PID 3884 wrote to memory of 3536 3884 cmd.exe powershell.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe PID 5060 wrote to memory of 456 5060 blender-3.4.1-windows-x64.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\blender-3.4.1-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\blender-3.4.1-windows-x64.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- UAC bypass
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-146-0x0000000000000000-mapping.dmp
-
memory/456-158-0x0000000006A60000-0x0000000006A7E000-memory.dmpFilesize
120KB
-
memory/456-157-0x0000000006F00000-0x000000000742C000-memory.dmpFilesize
5.2MB
-
memory/456-155-0x0000000005690000-0x00000000056E0000-memory.dmpFilesize
320KB
-
memory/456-154-0x00000000055F0000-0x0000000005666000-memory.dmpFilesize
472KB
-
memory/456-153-0x0000000005860000-0x0000000005A22000-memory.dmpFilesize
1.8MB
-
memory/456-151-0x0000000005530000-0x0000000005568000-memory.dmpFilesize
224KB
-
memory/456-150-0x0000000005400000-0x000000000542E000-memory.dmpFilesize
184KB
-
memory/456-148-0x0000000000400000-0x00000000004E0000-memory.dmpFilesize
896KB
-
memory/3536-139-0x00000000059C0000-0x0000000005FE8000-memory.dmpFilesize
6.2MB
-
memory/3536-152-0x0000000007B00000-0x0000000007B0A000-memory.dmpFilesize
40KB
-
memory/3536-143-0x0000000006D50000-0x0000000006D82000-memory.dmpFilesize
200KB
-
memory/3536-144-0x000000006FAE0000-0x000000006FB2C000-memory.dmpFilesize
304KB
-
memory/3536-145-0x0000000006D30000-0x0000000006D4E000-memory.dmpFilesize
120KB
-
memory/3536-147-0x00000000080E0000-0x000000000875A000-memory.dmpFilesize
6.5MB
-
memory/3536-141-0x0000000006100000-0x0000000006166000-memory.dmpFilesize
408KB
-
memory/3536-140-0x0000000006090000-0x00000000060F6000-memory.dmpFilesize
408KB
-
memory/3536-149-0x0000000007A00000-0x0000000007A1A000-memory.dmpFilesize
104KB
-
memory/3536-161-0x0000000007DB0000-0x0000000007DB8000-memory.dmpFilesize
32KB
-
memory/3536-138-0x0000000002E60000-0x0000000002E96000-memory.dmpFilesize
216KB
-
memory/3536-142-0x0000000006770000-0x000000000678E000-memory.dmpFilesize
120KB
-
memory/3536-137-0x0000000000000000-mapping.dmp
-
memory/3536-160-0x0000000007DD0000-0x0000000007DEA000-memory.dmpFilesize
104KB
-
memory/3536-159-0x0000000007CC0000-0x0000000007CCE000-memory.dmpFilesize
56KB
-
memory/3536-156-0x0000000007D10000-0x0000000007DA6000-memory.dmpFilesize
600KB
-
memory/3884-134-0x0000000000000000-mapping.dmp
-
memory/5060-133-0x00000000071C0000-0x00000000071E2000-memory.dmpFilesize
136KB
-
memory/5060-135-0x00000000080D0000-0x0000000008674000-memory.dmpFilesize
5.6MB
-
memory/5060-136-0x0000000007800000-0x0000000007892000-memory.dmpFilesize
584KB
-
memory/5060-132-0x0000000000060000-0x000000000007E000-memory.dmpFilesize
120KB