2b6e342cb6ef27de7ca0dda5bbba6b3871643835aea5ba9e77881883f6b0659b

Analysis

max time kernel
87s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bloxflip.py-main/bloxflip/account.py
Size

625B
MD5

365dbb0bd6d3cfdd1a4077e7c5ec66c7
SHA1

bcefb0d17dc1766d4d451bb656575e8dd8465c3b
SHA256

f2cf0c1d72b1a6cd223f3da0baba2bbf1edc33df5838b05a6e3c63cdc9651534
SHA512

61761b880b187970c09b89239f0cc702e26c83918d8459086aabe71899fe7173d9f0e071ac2be510d2e71e66e29d8f8796b434abccdfcfa01e26e24df0c953a8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	cmd.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
892	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	OpenWith.exe

Suspicious use of SetWindowsHookEx 47 IoCs

pid	Process
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe
2580	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 892	2580	OpenWith.exe	93
PID 2580 wrote to memory of 892	2580	OpenWith.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bloxflip.py-main\bloxflip\account.py
1⤵
- Modifies registry class
PID:4028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\bloxflip.py-main\bloxflip\account.py
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads