81cb7e6ec706cc389628e30765ef8b578afef21c550a3576987b4c4ae21415e5 | Triage

Sharing

General

Target

BlueStacks10Installer_10.10.7.1001_native_acf5835b6aa1685d2c972ec5ddafd575_MDs1LDM7MTUsMTsxNSw0OzE1.exe
Size

910KB
Sample

240211-wdh79aac3w
MD5

8a3a29b33fe8ba5232b90d95f8f78f50
SHA1

844a8db998948ba835d66174bd93174a68a7aeeb
SHA256

81cb7e6ec706cc389628e30765ef8b578afef21c550a3576987b4c4ae21415e5
SHA512

6f5c1e1bcce0460b302d7af268a5315f2e1c94b7e9119fd1c0f4742c5d826b04815b7b55624e17a03ff4a1ead1c2bad028a09ce419692208b0bb450494837bc6
SSDEEP

12288:SivtCXQd0gjKX7zuqGKFD779TxgE98I17YpNgc8gJ6N/Ya6yfP/3uhq/UUBPXtVh:SivtCXWeGKF9Txt9OkcoPvuhqcUB5u8n

Score

6^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  BlueStacks10Installer_10.10.7.1001_native_acf5835b6aa1685d2c972ec5ddafd575_MDs1LDM7MTUsMTsxNSw0OzE1.exe
- Size
  
  910KB
- MD5
  
  8a3a29b33fe8ba5232b90d95f8f78f50
- SHA1
  
  844a8db998948ba835d66174bd93174a68a7aeeb
- SHA256
  
  81cb7e6ec706cc389628e30765ef8b578afef21c550a3576987b4c4ae21415e5
- SHA512
  
  6f5c1e1bcce0460b302d7af268a5315f2e1c94b7e9119fd1c0f4742c5d826b04815b7b55624e17a03ff4a1ead1c2bad028a09ce419692208b0bb450494837bc6
- SSDEEP
  
  12288:SivtCXQd0gjKX7zuqGKFD779TxgE98I17YpNgc8gJ6N/Ya6yfP/3uhq/UUBPXtVh:SivtCXWeGKF9Txt9OkcoPvuhqcUB5u8n
Score

6^/10

discovery evasion persistence
- Adds Run key to start application
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionpersistence