Overview
overview
7Static
static
1BlitzedGra...12.exe
windows7-x64
7BlitzedGra...12.exe
windows10-2004-x64
7BlitzedGra...xe.xml
windows7-x64
1BlitzedGra...xe.xml
windows10-2004-x64
1BlitzedGra...OR.dll
windows7-x64
1BlitzedGra...OR.dll
windows10-2004-x64
1BlitzedGra...to.dll
windows7-x64
1BlitzedGra...to.dll
windows10-2004-x64
1BlitzedGra...on.dll
windows7-x64
1BlitzedGra...on.dll
windows10-2004-x64
1BlitzedGra...le.exe
windows7-x64
3BlitzedGra...le.exe
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2023, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/APIFOR.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/BouncyCastle.Crypto.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
BlitzedGrabberV12-main/BlitzedGrabberV12/Resources/UltraEmbeddable.exe
Resource
win10v2004-20230220-en
General
-
Target
BlitzedGrabberV12-main/BlitzedGrabberV12/BlitzedGrabberV12.exe.xml
-
Size
199B
-
MD5
02bafe634a181de6af59ecfb1a9a7230
-
SHA1
5fb944dc91a95007795d83f2037cfe42f0d959f0
-
SHA256
6288699c8a0e00de7329c8f642bc22e6d7ed873f1decd32f05231cf69cac4470
-
SHA512
3e4dc4ae10bf527b98608883638356a84aa9652707276981458b0d9c58f000b290f24b4fbd1794ef02484ccf5ff43d5b55ab7161f5c9f408f68f7caa0676b362
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31026766" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31026766" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388185874" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500c76044e6ed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "15315966" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31026766" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "50160938" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10698b044e6ed901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2ABFEF1B-DA41-11ED-BDA1-5E272E2E2FB8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca130200000000020000000000106600000001000020000000cf7c4fec0a1e72e73732a04ce7684a3cbe8baba95fc54c3d86f724d35c002e59000000000e8000000002000020000000a5accc0a4dbb0b50b24b293c0ee3b4d4275ea50b3edf46d6a78f44649e45fbf020000000da23df161dec0151b73f34d384169292f49ed56fc562a593b122e2a4f53254c2400000006c7f5ff33563079e339f2313fa3bc5202a065a40cc5832b6ca05f42ccc933ad1b69e38e6c09e5f559cf4d0a0e0b0c134084fe9a5ede2e1fa825f228bef3b9d66 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000eb827cf93ddd146af8365c0e3ca1302000000000200000000001066000000010000200000008441cf7eb7296786cf967e6c86f9a77993fb1a892e14d4ea82edbdc830f063b9000000000e8000000002000020000000bc021250d41c7baecf328bd0a6cad54d9a9def286cba6cf0881f4009b0e8590e20000000b835d8e08af4a14d6bd3cdbcc8b4a03a596daaacb7c2e751cec667422d6b6404400000002c9c67cdc0c7aabf37c02d9bcff6b9a14d5c05ced6daa78f4925d2d33a45fed676a0cd6d96ce8011271ab0cd851e017e33a78ada2ec270b4db710575fe71c4a3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "15160344" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2032 iexplore.exe 2032 iexplore.exe 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2032 1916 MSOXMLED.EXE 83 PID 1916 wrote to memory of 2032 1916 MSOXMLED.EXE 83 PID 2032 wrote to memory of 4280 2032 iexplore.exe 85 PID 2032 wrote to memory of 4280 2032 iexplore.exe 85 PID 2032 wrote to memory of 4280 2032 iexplore.exe 85
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12-main\BlitzedGrabberV12\BlitzedGrabberV12.exe.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\BlitzedGrabberV12-main\BlitzedGrabberV12\BlitzedGrabberV12.exe.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5dd25eece262055fa2e7c798da8245627
SHA17f8dff5bf53fc2a6775d657cf30e43c712333a5e
SHA25667d71d2d39ee7819764bef14658bb14d434a0969010f4a63936a478e55441637
SHA512268aba5ef911eb1dec777fd52bbe230adceefae7b6c145e41d1ab4531b6e3f2858141325d4da67422078181fdf7641df475bb68384cecb334a3c24bee62676d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e8392651321f87e3ed45adfbb9963dde
SHA12681d4e4d69061f06d3e6521f87c8304f96dd7a0
SHA25656a7cccea3cb6cdee9a73c416bc77daab8973ef78ec520cd9af6ff4837c4259b
SHA5123d75882c19847e7af7d089b09d08d4b08ea2c5b09dc3c17ac890f3a9bf2b42637bddb6cbf1455521d2562ec0cbe3e26a83156f63123819ab7b434a529bb6da18
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee