Analysis
-
max time kernel
44s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2023 16:38
Static task
static1
Behavioral task
behavioral1
Sample
BLTools v2.0.rar
Resource
win10v2004-20230703-en
windows10-2004-x64
3 signatures
1800 seconds
General
-
Target
BLTools v2.0.rar
-
Size
2.2MB
-
MD5
d500f0b995a897d3a01c0b393632a82e
-
SHA1
13367fbac0893aa1e7acce3f00570cb8431d0abb
-
SHA256
fe7b1c4c3c432a072c620a993838a27ef0d5b43dbc24b03bb28641106b98b645
-
SHA512
58384e53b15d9aaafea058edab24411c193fb0a83723e2b0fcc24a1fa2d30b4847873e528b0b66fc8184bd3e498d5d8a596e0c83be58eeac53eaa0a2c59f5a0a
-
SSDEEP
49152:m2QHl5kNlNJU9MyAUyi9Qhyrq769EQL38xCOofjuZpHYatpYrG:0ArU9MyAUrFrSls38oLub3mrG
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe 1440 OpenWith.exe