adeb24697fb2c829c513f1812aa5645717640599a5aeb964d45ec616e0ebd6b6

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

blur-installer.exe
Size

56.0MB
MD5

cc8d0921084401992c3f84cf6db0a9a5
SHA1

0f85447fa43ba0d77d60e857ed238f046347c4c5
SHA256

adeb24697fb2c829c513f1812aa5645717640599a5aeb964d45ec616e0ebd6b6
SHA512

dc662cfb40416553cad0738fe4c7407f3b04457f47bd766832a694f896e5834956eefe5bacce32022de33bca1a637e85f589479fe38b89b03ef259439753e644
SSDEEP

1572864:njXb31SEpfRrEE1sioTNq9ikYyjgL7c31nppNOnFMQi:njx1J7+ioyikY+gH41nppNlH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5048	blur-installer.tmp
3732	VC_redist.x86.exe
3948	VC_redist.x86.exe

Loads dropped DLL 1 IoCs

pid	Process
3948	VC_redist.x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	blur-installer.tmp
5048	blur-installer.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5048	blur-installer.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 5048	4340	blur-installer.exe	84
PID 4340 wrote to memory of 5048	4340	blur-installer.exe	84
PID 4340 wrote to memory of 5048	4340	blur-installer.exe	84
PID 5048 wrote to memory of 3732	5048	blur-installer.tmp	93
PID 5048 wrote to memory of 3732	5048	blur-installer.tmp	93
PID 5048 wrote to memory of 3732	5048	blur-installer.tmp	93
PID 3732 wrote to memory of 3948	3732	VC_redist.x86.exe	95
PID 3732 wrote to memory of 3948	3732	VC_redist.x86.exe	95
PID 3732 wrote to memory of 3948	3732	VC_redist.x86.exe	95

C:\Users\Admin\AppData\Local\Temp\blur-installer.exe
"C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\is-7SEFJ.tmp\blur-installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7SEFJ.tmp\blur-installer.tmp" /SL5="$140048,57819947,879104,C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\is-4GK0T.tmp\VC_redist.x86.exe
    "C:\Users\Admin\AppData\Local\Temp\is-4GK0T.tmp\VC_redist.x86.exe" /install /passive /norestart
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\Temp\{53DF0448-CCA6-44D4-9BD0-0DF9BA908299}\.cr\VC_redist.x86.exe
      "C:\Windows\Temp\{53DF0448-CCA6-44D4-9BD0-0DF9BA908299}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-4GK0T.tmp\VC_redist.x86.exe" -burn.filehandle.attached=648 -burn.filehandle.self=656 /install /passive /norestart
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\setuptools-58.0.4.dist-info\is-JQG89.tmp

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\wheel\vendored\packaging\is-LF4AT.tmp

Filesize
1KB

MD5
b0dac8ef6953fb835c7d633e6a427ba7

SHA1
f521b39e0501e178412d557ac85d625626b85326

SHA256
c79f44850e7b4cc4fe9134722d9576e4766f6061b06ee713a3a88a87f3b4b4cc

SHA512
de5d2189075a26dc2e9ba41c1bbf2d4ccd3d5fb475802a0d7a70e311a301c4c4cb619d9f15c6263a420583b4f8bf87fcd589d6f96fe7b1edc367b875d54cfdda

Download Submit
C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Scripts\is-PS118.tmp

Filesize
103KB

MD5
449919a8dbc0882ab75fbeb012634dd7

SHA1
c457948d731f7d414a0f06a75c348d4035b19c86

SHA256
f5ddfb8a27580e38c964a5455704a51df94e3796723ba145ed8ac44734110e93

SHA512
0d0d94e063d6c49c4e4fc8e1dd933e6a4acca48cd875d274543a134b849f0db2aa5f92826c0dc3f728817b9adf005947ca0f94c878ae139ac9d372518c43fb91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4GK0T.tmp\VC_redist.x86.exe

Filesize
2.4MB

MD5
1e9c591e601e8d11e53a6a97bd5d89cc

SHA1
16ca724414a7b88263109243b5ecf88faa03a010

SHA256
edf358af8f309b005918694e64570e719840827a260baff7ca942a2eb002b684

SHA512
ef71ec74d0f0de0e04d175b734c07010921f22e81616657add1af086e9f4147c3c530738f82ca026d262c7ce51b696752007cbc4413e96954f21ba6a14bef081

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4GK0T.tmp\VC_redist.x86.exe

Filesize
2.9MB

MD5
de3931fe0894d09eae06b4985d27bdb0

SHA1
a428644ece332d8ff9a880bd73fc2351ef6be07f

SHA256
4a78e634a6b6236d0f29441464cca4c673679deb8b49df3724399b0a43832752

SHA512
ee5978f5afb072e07ca90aa6bb8ef1659264d29f99cd234ced6118814cc421cb56b30cc4090543cc4f5a6d4225796486ffd52f21ea1af798c3555ae3a1e35af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7SEFJ.tmp\blur-installer.tmp

Filesize
3.1MB

MD5
4c1da6e07f377da9421c0bd4cc33ac72

SHA1
d7b292b13008e485fdb69f44d7e4ed15fea9a221

SHA256
dea7aef5837642ed3243e95ec640b6404f06a8fbe210a82ebdbc76859c57c3c8

SHA512
555559c738e2db80405b1a486403f1c384d291dfc3b526290b9d50f5796f76bb6a8e85e1d99c5f9fa022b4c06994c20ceba55bf6eaa6d0b9e81f3893c4a14cef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7SEFJ.tmp\blur-installer.tmp

Filesize
2.5MB

MD5
dedb0a428a49a815728f2618bedfbaaf

SHA1
5b3488ecabdf08b8b9082c03f4c00d68d1432a2c

SHA256
72fd13d86fb3b050faf622a975db1747fa72532850af3695c111a747eb6dfc53

SHA512
a65e2ddeb51456e4a4a332016808737b2d0e0066892d5900d788e28c07fcd92a01be7f79d42e64ba5f28f588cf800f3caf1313e8b5d3793e073f22188710bcb5

Download Submit
C:\Windows\Temp\{53DF0448-CCA6-44D4-9BD0-0DF9BA908299}\.cr\VC_redist.x86.exe

Filesize
632KB

MD5
1636039e4940c80acaeb369852f79cef

SHA1
7d2b5110d1bf729d7fcd9e42a2b01a58dcc66a69

SHA256
d116ecd1f04402430eb8ff5e07357f7ab2a2e0aa12dd6c5156e7f92705568e0e

SHA512
3ba5c3225b74594d6121a45f225204e8eb4b80afc60849fe78a933afcc81f8db7221cdcbe5789ade1b3f2d784dc3659c08692f7bd808b85198cb78e601d8da02

Download Submit
C:\Windows\Temp\{AA2A0BFD-763E-438C-A40C-8905ABE6BCFE}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{AA2A0BFD-763E-438C-A40C-8905ABE6BCFE}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/4340-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4340-7-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/4340-2499-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/5048-2400-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/5048-5-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/5048-8-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/5048-1699-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/5048-2489-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download
memory/5048-2498-0x0000000000400000-0x000000000071E000-memory.dmp

Filesize
3.1MB

Download