Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
02/10/2023, 11:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.upload.ee/files/15753410/BLTools_v2.4.zip.html
Resource
win10-20230915-en
General
-
Target
https://www.upload.ee/files/15753410/BLTools_v2.4.zip.html
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4488 BL Tools.exe 4904 SecurityHealth.exe 4088 SecurityHealths.exe 2972 BLTools.exe -
Loads dropped DLL 2 IoCs
pid Process 2972 BLTools.exe 2972 BLTools.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\ProgramData\\SecurityHealth.exe" BL Tools.exe Set value (str) \REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealths = "C:\\ProgramData\\SecurityHealths.exe" BL Tools.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133407189384230469" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 chrome.exe 4520 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
pid Process 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeRestorePrivilege 4836 7zG.exe Token: 35 4836 7zG.exe Token: SeSecurityPrivilege 4836 7zG.exe Token: SeSecurityPrivilege 4836 7zG.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe Token: SeShutdownPrivilege 4520 chrome.exe Token: SeCreatePagefilePrivilege 4520 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4836 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe 4520 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4520 wrote to memory of 4068 4520 chrome.exe 70 PID 4520 wrote to memory of 4068 4520 chrome.exe 70 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 3704 4520 chrome.exe 73 PID 4520 wrote to memory of 1096 4520 chrome.exe 72 PID 4520 wrote to memory of 1096 4520 chrome.exe 72 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74 PID 4520 wrote to memory of 2384 4520 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.upload.ee/files/15753410/BLTools_v2.4.zip.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb467f9758,0x7ffb467f9768,0x7ffb467f97782⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:82⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=232 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:22⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3672 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4732 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3020 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2972 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5220 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:82⤵PID:3316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:82⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4780 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5956 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6112 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5764 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5956 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:82⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5504 --field-trial-handle=1764,i,1101703328266700852,1095087025761202833,131072 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2352
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3216
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BLTools_v2.4\" -spe -an -ai#7zMap19634:86:7zEvent280541⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4836
-
C:\Users\Admin\Downloads\BLTools_v2.4\BLTools v2.4\BL Tools.exe"C:\Users\Admin\Downloads\BLTools_v2.4\BLTools v2.4\BL Tools.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4488 -
C:\ProgramData\SecurityHealth.exe"C:\ProgramData\SecurityHealth.exe"2⤵
- Executes dropped EXE
PID:4904
-
-
C:\ProgramData\SecurityHealths.exe"C:\ProgramData\SecurityHealths.exe"2⤵
- Executes dropped EXE
PID:4088
-
-
C:\Users\Admin\Downloads\BLTools_v2.4\BLTools v2.4\BLTools.exe"C:\Users\Admin\Downloads\BLTools_v2.4\BLTools v2.4\BLTools.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
234KB
MD525fbd64645f4ed44e64e4cd5c3817a53
SHA1f0579645e9e7f729aa9372e0455748a7aee5dc49
SHA256adce7ca3bbea5346603783d5d97829b9279a1516389f4a94c4498fdb9a68f188
SHA51209d56f031d762d7bef0d74ff2ff015f4fc3d12dcf865aee48e2202275d294a05e9e288efefeb8d70f851d29021c9e35d88efd9591d724ca3e5c65c83a3853b55
-
Filesize
234KB
MD525fbd64645f4ed44e64e4cd5c3817a53
SHA1f0579645e9e7f729aa9372e0455748a7aee5dc49
SHA256adce7ca3bbea5346603783d5d97829b9279a1516389f4a94c4498fdb9a68f188
SHA51209d56f031d762d7bef0d74ff2ff015f4fc3d12dcf865aee48e2202275d294a05e9e288efefeb8d70f851d29021c9e35d88efd9591d724ca3e5c65c83a3853b55
-
Filesize
228KB
MD5364b7b10f968ae17b31499f6b08a6139
SHA1550fbe7e8e356cd945ccd1be0e250c7d70538009
SHA256b9155f0676dac46541de618bdf1171ea5e5490cc44d3b95e9a364cf3e624814b
SHA512accf988465b72c92575ec4ad45ec923b20dbca76fc199de02e704d249303ee0a57861f2d0cea57ee4bbee7bc9d262d23370cb71e63a044d4297d365690f7a3e4
-
Filesize
228KB
MD5364b7b10f968ae17b31499f6b08a6139
SHA1550fbe7e8e356cd945ccd1be0e250c7d70538009
SHA256b9155f0676dac46541de618bdf1171ea5e5490cc44d3b95e9a364cf3e624814b
SHA512accf988465b72c92575ec4ad45ec923b20dbca76fc199de02e704d249303ee0a57861f2d0cea57ee4bbee7bc9d262d23370cb71e63a044d4297d365690f7a3e4
-
Filesize
480B
MD5586afb1b213abbe6d2f83a58ef7a6cbe
SHA103c4922e6f8b4d567c313c05f4ca3cbbd5e07528
SHA25693b18192fd9e96291c68e0df72fb169a97a47eb1b36902cbfd631eeaa24ab80a
SHA512df345cc414cc426fa09f57c1f7ed8848e21e916182d42bbf0f90e0c36693495626e69081472ef79d846ee8e4c11af934e681641de7587f04fcf304829a320f50
-
Filesize
1KB
MD55d746e5f441d0a748f87eb7e4dfad2d0
SHA1d61d56e5a6b629c5075083d79fccc92dc6d78922
SHA2562513340431bea1720a474107599e7c7c80b3b8af4d65da21d7150285a3fd1317
SHA5124d3c248d68e294fe2786e23299500ec08ee62a05e5c047592b13cf0ebb0e1788cf787fba3ce9dc2e8918d11c23d00284cc315845bd87fe82dda7d27a406a2b3a
-
Filesize
1KB
MD5b87abff2dee1d918ace6102c2e0f4d11
SHA104a8a21ff81e4d7b473db3b117e020029ae7e8ae
SHA256b89a0a2f7df29592c8779cb325a63a827e105d81b7afb694737eb62eb2e541ef
SHA512df4245bc5ffa2853ea09a43e954b88dc2503ae2a3574dd4b64da91c4e2e18f39e5a01079e16a9f815c64f086376ae404e74c5ee8e4663186fc37e783dde8b8e5
-
Filesize
6KB
MD5bb01d544801b6898421d98fdc05d5cc5
SHA1ac881756c190662936f0594c94bdabe8df433cf8
SHA25696625c954181c0b65c3a3558a758b974faf5507a9586b1872aeb1a7591e95d60
SHA512297598b5d54772561b95a750f4134a3d322a7e3086e7e31121e4066d311ac053816b6fc4e3f3775b4e7117e2e760c1b8ef0587daaf0466198759401f592bba44
-
Filesize
6KB
MD5a1b30a4c5162d6ffaca1a9cae89eb671
SHA1dac613cd27a7a8a650b67907d3a00b9e98be3d4c
SHA2569016eb04db62fd7fded5f74411b65cabf52342528d0b3d41a8bfa7cd3f71c68c
SHA5121edeeac1b577b20ba358d20cd25b42cd69ea2c2017fb732f3130267e14df8c87d17e6d51286a2c0d51562f31640126bf5afd9c960af204ddb0f27acd5d683f07
-
Filesize
101KB
MD5dd8125106190ad2d88b0bb377fd1f9a8
SHA199f994ed2a381a8aa64bb3829c7c6c95fca02c4b
SHA2560e58c96c5ccaaab4cce49d18c6acfc04f784ba9f8dea5df625926087080a0bc2
SHA512e5f28dde2d9d341be2b02e9cec751bb26189786112e98da50b885d725a61c3f899e6683d6204150e722cd278ea4328a07bb424aea1c0614c8d4c56cf2927ad2d
-
Filesize
101KB
MD58959b55277cf75a2890d3bd25a304099
SHA12adaf68d215f97f3e861690c3bf314376288f884
SHA2569ffd38ca40a28bfc57e2d51da2d304a7c4346013bbe596be05a9557c35a95f27
SHA512cfba6850b75939a9940ecf640e37060ce7a1b86cc9921545919914c206957a9b36d37d32bfcb6dbc3dae7c5e5353da5413fa2ed5e95d5d8a963e099c0cffd1ee
-
Filesize
111KB
MD53e637c93bd34e39660287d6adf7820fd
SHA166ce80ca14bbf5657b829120105ab2ae75a7c0d1
SHA2564b75d8c4bf65e56f0c66bc73f497f4c5af42374401a0177f574e27f9c89f8dbc
SHA512b50a9bfddb27aff41fbea81264c9633f783929c2e043366544837dfe35c8f0b73eb1b7b551ec2d8ceeef33ec595f4220f362ccd3fc7891d116b0dca833cea1c1
-
Filesize
100KB
MD53ad9481161b79b46adedba7087b31e5b
SHA13fa2f5cc7a4dc8af663164d4ef55085f87abb934
SHA25629f122996f32f44ce3af4b8ca63691685895e88601e5a829cd892e15045ff265
SHA5127110613a0ff57013134c2210b1998aa088f69c7ef7281290e18b9c5915e30af54bbf03de33b75acc3f1f46c2e46c4e3ad2a1794a4fde1f9914d4e786dfd9c796
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
2.9MB
MD53860f910ce2f28f881c2303d8a35b1d2
SHA1247a08cee7efc934af7423e2132f55cb8eec6e35
SHA2566a9d054b3a14fcac39d9924fb0d5cadbee373059a61aa1e49d368b02c3f9ed7b
SHA5126544bf1aecdfd44729a074707f6b90c4b63e00727066a2601442d9da7b74e7548bac3287e413051b8118fcf10d62cca3e564f57c3133b8372ccfcff9f424a635
-
Filesize
1.4MB
MD5337d279e0b15254b30bea078706e6a86
SHA1a21d747f743aca044ee8e90ef58a2f6f950eb0cf
SHA25612c61522f095fc5e4d9eab66f82ae3328b3df29ae4ad9153a1a9ed48a7b08100
SHA512692e3850f818d0e0ae0d6440624133cd46194467f761b561be08a423050d1d04ba75fedbeb7ebbd1f4cba427a0acfa6d5913efa825fc0ca3ac276f57721d49d3
-
Filesize
1.4MB
MD5337d279e0b15254b30bea078706e6a86
SHA1a21d747f743aca044ee8e90ef58a2f6f950eb0cf
SHA25612c61522f095fc5e4d9eab66f82ae3328b3df29ae4ad9153a1a9ed48a7b08100
SHA512692e3850f818d0e0ae0d6440624133cd46194467f761b561be08a423050d1d04ba75fedbeb7ebbd1f4cba427a0acfa6d5913efa825fc0ca3ac276f57721d49d3
-
Filesize
4.0MB
MD565ecc99b0c162d11b0094e56a1ea38f3
SHA1629a89a0cbcb36b5fb0a0d5e5f3b6f32df3858aa
SHA25655edf9a8e5d3fd3f647f26f593ab39e511cac2abf0e444ef82c309b5c78067fe
SHA512478d91b811969543fc752139b0d7a4bbf3eb74162cf05bc8121add3f3f5e64e3b8bdddea3aa30c851f1522c5db29470c0cfa9f69c0b07795585b92a6370ebb74
-
Filesize
359KB
MD5f2f6f6798d306d6d7df4267434b5c5f9
SHA123be62c4f33fc89563defa20e43453b7cdfc9d28
SHA256837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd
SHA5121f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211
-
Filesize
359KB
MD5f2f6f6798d306d6d7df4267434b5c5f9
SHA123be62c4f33fc89563defa20e43453b7cdfc9d28
SHA256837f2ceab6bbd9bc4bf076f1cb90b3158191888c3055dd2b78a1e23f1c3aafdd
SHA5121f0c52e1d6e27382599c91ebd5e58df387c6f759d755533e36688b402417101c0eb1d6812e523d23048e0d03548fd0985a3fd7f96c66625c6299b1537c872211