Overview
overview
7Static
static
1BlitzedGra...12.exe
windows7-x64
7BlitzedGra...12.exe
windows10-2004-x64
7BlitzedGra...xe.xml
windows7-x64
1BlitzedGra...xe.xml
windows10-2004-x64
1BlitzedGra...OR.dll
windows7-x64
1BlitzedGra...OR.dll
windows10-2004-x64
1BlitzedGra...to.dll
windows7-x64
1BlitzedGra...to.dll
windows10-2004-x64
1BlitzedGra...on.dll
windows7-x64
1BlitzedGra...on.dll
windows10-2004-x64
1BlitzedGra...le.exe
windows7-x64
3BlitzedGra...le.exe
windows10-2004-x64
3Analysis
-
max time kernel
100s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13/04/2023, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win10v2004-20230220-en
General
-
Target
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
-
Size
199B
-
MD5
02bafe634a181de6af59ecfb1a9a7230
-
SHA1
5fb944dc91a95007795d83f2037cfe42f0d959f0
-
SHA256
6288699c8a0e00de7329c8f642bc22e6d7ed873f1decd32f05231cf69cac4470
-
SHA512
3e4dc4ae10bf527b98608883638356a84aa9652707276981458b0d9c58f000b290f24b4fbd1794ef02484ccf5ff43d5b55ab7161f5c9f408f68f7caa0676b362
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388185862" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000b7fbbd9605b95644b7a1180e81b8c00182a20a782bdf70495d24ab0e2ee7124e000000000e8000000002000020000000a06e229fb7c88b61858484f946fb53a2128a2d0181d670984afa3958bcefb21f20000000f7c7540695d9084da99cc9d3b2c144c87439b6fa10c9b4a60a086049dcd26b694000000043b148e1c7ce5862c918ec8ef37f8ed67d5b0b956d9ddbeac58120602131431f3e86a34bff7812c42014a52157b1c622ff3ad7ef723e4e463ca3a65f74aca4ed IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a0000000002000000000010660000000100002000000087737da2257fca3b8b6947a0418afa105ece228bd036389fc4eca97b2b516c45000000000e80000000020000200000008032187773a23abd099daa73ae917c249d1ef6b48f83fbaef9becc9012a1ac2a90000000c8e87054512dd3200ccdd3563bd059f9aa548f0a8c012bb45c66770ef02329d5515c39ebbde3cdf5796a8a9c63bd050ee8a890dd63a1d0e6d21d00118b31f3ad59f042ef89e5db8456ad1b27b59bdbb97bcd9379530f021a735c621b630d902678a6d2652d0afc69d01da0bdf54512a7ae5bab3d87e3e1c1a7f69a48218f2ed2567cd78a5b4aea314e42685a5e11f90f4000000052110a6bae3fc9dadd8856773d3f86b0ea8b49da6c1f3c7d8090cdb2fd5a4939752505d77c1fe2f90fa308c050e4a2a8323cf254169aa4928841d65d2356c2b0 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0386bfd4d6ed901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26A31201-DA41-11ED-88FE-724BB54F6CA2} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1392 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 524 IEXPLORE.EXE 524 IEXPLORE.EXE 524 IEXPLORE.EXE 524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1992 wrote to memory of 688 1992 MSOXMLED.EXE 28 PID 1992 wrote to memory of 688 1992 MSOXMLED.EXE 28 PID 1992 wrote to memory of 688 1992 MSOXMLED.EXE 28 PID 1992 wrote to memory of 688 1992 MSOXMLED.EXE 28 PID 688 wrote to memory of 1392 688 iexplore.exe 29 PID 688 wrote to memory of 1392 688 iexplore.exe 29 PID 688 wrote to memory of 1392 688 iexplore.exe 29 PID 688 wrote to memory of 1392 688 iexplore.exe 29 PID 1392 wrote to memory of 524 1392 IEXPLORE.EXE 30 PID 1392 wrote to memory of 524 1392 IEXPLORE.EXE 30 PID 1392 wrote to memory of 524 1392 IEXPLORE.EXE 30 PID 1392 wrote to memory of 524 1392 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12-main\BlitzedGrabberV12\BlitzedGrabberV12.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:524
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57a5ad311f29c56edde87a45973d24423
SHA1e36a1b6743a5601af1da5beb60a73a2e76d26b25
SHA25670fa592340454596813513ebe8fd65f8a9701cb3735351bcd6edcea0701d7ec5
SHA5120c72c9f54752c480d7a70d899ab6829a31a62061abb515794d505d001e247f7bd640d7a915ca985ab181553c9381828c1537cdb1b6de4039a7f219ad5c785cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e8dd1dee2db8209af7a1146b3b785f2
SHA1574d326fb7668c3366965005322608952d713f50
SHA256d73d99e555826b84450e57d06169acde4ad4428545d38734b132b9c6594313f9
SHA512843327224b21b8522f7b1d6607e82c4a8cdb86fdfe857671578fcadfe9a5cebb36a2b6f1095c0a991cab23855fd87e5965c5d8a2e511dec3ea8b3169e73fe657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52d1b527ecbdf91171ad39923cf2a7f3e
SHA1c6125628c7d829a8c0dcd46365c994be1c0a485b
SHA25611d0c43d4d8cd686933a9f89aae7b044c0418c2ba22ab763fab943d4ebb08c3d
SHA51286f510a34b3830b2b8be6b73fbd4f373ab3169cd5db5765c148147f6a9fb83c7d82763047b60fbf6109e424b3370394221a7342c5f19d9ecaf52315a6696ab0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5269e4cd371ccddc31edd7bc560983e8f
SHA14b974bd49bb4208554fc19c0e595ce5653fc2055
SHA2560d49e45d1bce3aa89aab93cf341c7e1974142a12885a3fc3e994244b438786af
SHA51261c42d57c0f67bd38efd8f829b544d2a9244dabe5eba3d5a24db210120f567b5a4eb6437849d4fca8067891edf1402b01427697a9a79b79d6e1ac6f031af668d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eb8308140d128c46313c7347c238b707
SHA12961d1130cb1e800daff6ed740b6f0e312c8790b
SHA25660c09e64ed28cd9b2b584bfc84c7b9638f569e83f223f7bd88f2fa22cb6ac391
SHA5121a65050eb31da48733106854b4c21eda9d8d481cde58cfdd3014a7e3ebd8ecfef60fd98e1ec5e15738a22d5bc55553b52e9d95f5ec02fcf4c99782ce556272bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f688de5656d46e931e7361ff989c92a
SHA1180f073aeb14a89ef20a3a659f16a919f39ecbe8
SHA256a389f85ccfdc2a4a8c0d7e96393511e9b2b59f2425aafa96d03b8ac3b71b08b7
SHA51280216e2b0ea0308f15a36941c67651938d1c3dfe0b28c0fdd87bb7100329f40e12ccf0fd3fc92744b4082795c2862a82cab7d94004982888a650bc63022c7fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e562bf0546756b33d754a24fbbd3506b
SHA1231172b7f5241feafd855e95afa4b7a29dde0ca9
SHA256fb64091ebf4da3bf52c6c81e82fa707a2ca900da340cc0f0604735af96d3d10d
SHA5120af1bb8bdc029eaefcc3911b5406738a92778c1d7b5a7757d3cffeb4ef29fe2fd099e7f8088641acfdf9b47c3c75abedd3a815def529b5febaee766d348670cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e6d3140ea0d8c30f78023807f573cc9
SHA1a514781c23899cdd11fe85fa13dd89c07749d0fe
SHA25695813117488bff6cfcb6dbe0803314698dad7d1bb272059826f032cabfdd142e
SHA512545581523cbe3f1717df36ed19f21e28830f147d1ec677d7c7cbf59a1df8d5cc9628a3f864bd82d22544548bb144ca8cb987843c8dbeb9afdc8bba2559e51a76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5393107f58e705e36b090609865b8d614
SHA18ec5702169467e605da169d404994fa0d26f9a33
SHA2562a9d73a235b435e3fe0d39c34a7cbb989ae05d1bfdcca0e32bc8de4a6f69f302
SHA512b889c9e5a33a95e2d98c949ea681081af2c199e942f493da9eae6751481bca7a8e9ec85b3ac2ea10179d2a15d2afa8f409c07692c5159a909ca9c8a4da605966
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
Filesize
599B
MD517562ee9a1b5fa8a823435d1e07ed4f6
SHA1fc74911ba3cf9fcc0a5e97a33621f00776e0b05f
SHA2564988e836f542b9f3604941a0a53f215ae441ae041f4b73752773deaad1ccf7e6
SHA512a5c274fbca3ddf15f0a2ec5321dc948c08bc0af9d3386eaa9ccdc41fd10208582ba88d30153a6f2ddd219ae11ec6ee2e5b135680dd8d13639f8aee8d8044ab71