Analysis
-
max time kernel
9s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe
Resource
win10v2004-20240221-en
General
-
Target
BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe
-
Size
910KB
-
MD5
137ba5b3972ec34519a73c9ce33fa437
-
SHA1
dd9dc2d0fb7e9554d24bb023fbf198dcaae1591e
-
SHA256
3e708816fbbc73b2b3de8b8fdad8d0e5328e55d8f91f6acf6673d0c517a5a732
-
SHA512
1614b37628cdb2112617bf5f65adfe63675285303db00f9ed36ea5f48fcef687e7462c452d01219b684ed21623353000796128e43e76dcdba69322f0d743b465
-
SSDEEP
24576:ZivtCXWeGKk9Txt9OkcfOT5+3S8L24ier33laL:EtCXWPtvz5cfid81iI1aL
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe -
Executes dropped EXE 1 IoCs
pid Process 2576 BlueStacksInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2576 BlueStacksInstaller.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2576 BlueStacksInstaller.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4276 wrote to memory of 2576 4276 BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe 87 PID 4276 wrote to memory of 2576 4276 BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe"C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.10.7.1004_native_ce7831f0822d7ceda4024b72f1ac8b5b_MDs1LDM7MTUsMTsxNSw0OzE1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\BlueStacksInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS4B0248A7\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cloud.bluestacks.com/bs3/help_articles?article=RawMode_help&oem=nxt&locale=en-US&image_name=Nougat323⤵PID:3584
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd50446f8,0x7fffd5044708,0x7fffd50447184⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:24⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:34⤵PID:1256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:84⤵PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:14⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:14⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:14⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 /prefetch:84⤵PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:14⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:14⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:84⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:84⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:14⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17382937331789945010,4157309815950489084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:14⤵PID:1012
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4420
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4276
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x424 0x4e81⤵PID:3840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56fbbaffc5a50295d007ab405b0885ab5
SHA1518e87df81db1dded184c3e4e3f129cca15baba1
SHA256b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6
SHA512011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b
-
Filesize
152B
MD5360dd5debf8bf7b89c4d88d29e38446c
SHA165afff8c78aeb12c577a523cb77cd58d401b0f82
SHA2563d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef
SHA5120ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542
-
Filesize
7KB
MD56d4102c2e9af2a84fa16b2845aa93f8a
SHA1388b1e6b47fae2c4940304de8d77e18bb9391ea8
SHA256bd9b848fe3cfb020ec82bad5637241388986c17c726151503e4a238ad17c314d
SHA5120f9ad76462f30f73ced1708eb0acb8b3c3c9599e534609e23ec47ff4f77179223d1ed4fa199c90a90e78539cb1307dc20326a71297c5866d2feb3f74559f0962
-
Filesize
6KB
MD5555eeccb48c89d35966d33410c015a9b
SHA1e31a60dd3105bad36dd5d501ea81e5f801ae681c
SHA2564c5f15d0fedcac40ba5c583bd22d240f42d95741c1c85c9bf60ac3c5b66a4e3b
SHA5124c046cd1f51bcd2cd5419edebdc4c0c50cf799f82d073f788a2525873d0a01435fd04b161e96e73db10f38ed7416f6d04e5baa618399bec2fb4452a14aef4afb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize35B
MD5343859b4ad03856a60d076c8cd8f22c3
SHA17954a27de3329b4c5eefd4bdcb8450823881aad6
SHA2568c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
SHA51258014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe5878d5.TMP
Filesize99B
MD56c1259a91ef901808813f2be8c4f44d2
SHA1c3a9d3370652576bb672e32959e44cdbed181405
SHA2562ae317770815cd0faeb3a198c91438d886a1efe54c30ce759c17e11deab8214d
SHA512fd965279ff3641670daaa8bbce4d3561f83913355c104f213b6a8ec284482d0a9efe83f99d41d2f79cdfdda4cc9763ff3d9654b34ec737b62a8f77bd8b950d1a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ffdc88af3fb9839fe6115c9b72834c67
SHA146200c7ad0e465b21df561bf368a4ddc6643ecbd
SHA2564711ae1294e3ec2087ffefeefe0fd300b559c631348272ea0b283f5bf294e29a
SHA512a4786d79ac024a745ac718bd3d970dc344951e298d4077f9b752471a84d567e337258d6db7d145157698e3389af87b759414fdc301aed794cdf21101d6dbe8b0
-
Filesize
1KB
MD54aaf83d2b3fd56ad806708e60474df39
SHA1144777a265879b69fadea3eb3ac6939458918578
SHA25684e59d14d9433e6c3d92daeb8c443063b5e3be6c0b297f0403dbde473a05cb3f
SHA5123b8485f054fe6ed2374bc81cb1786f09741219fbfcb22503707b11cf5db1ab262ba4349633597d5d9ddabc3415b170fa8eebc932f58d211d7092b8fb96fa1304
-
Filesize
670B
MD526eb04b9e0105a7b121ea9c6601bbf2a
SHA1efc08370d90c8173df8d8c4b122d2bb64c07ccd8
SHA2567aaef329ba9fa052791d1a09f127551289641ea743baba171de55faa30ec1157
SHA5129df3c723314d11a6b4ce0577eb61488061f2f96a9746a944eb6a4ee8c0c4d29131231a1b20988ef5454b79f9475b43d62c710839ecc0a9c98324f977cab6db68
-
Filesize
279B
MD503903fd42ed2ee3cb014f0f3b410bcb4
SHA1762a95240607fe8a304867a46bc2d677f494f5c2
SHA256076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1
SHA5128b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857
-
Filesize
212B
MD51504b80f2a6f2d3fefc305da54a2a6c2
SHA1432a9d89ebc2f693836d3c2f0743ea5d2077848d
SHA2562f62d4e8c643051093f907058dddc78cc525147d9c4f4a0d78b4d0e5c90979f6
SHA512675db04baf3199c8d94af30a1f1c252830a56a90f633c3a72aa9841738b04242902a5e7c56dd792626338e8b7eabc1f359514bb3a2e62bc36c16919e196cfd94
-
Filesize
622KB
MD5d806c620a28904ec2af48c213a562dc6
SHA1878594aa27189f4b6703c0e8e3bffa3dc810faa7
SHA256d2f0a40bf13d35a39b311cafa40653dc3c3da335bf5179e74babe79482e929c5
SHA5125d980c3edbad0ad2ac010e65dcc14e81a8154c59d56cec4e98bc04e9f14f65dc4cf6ddfcd29f82ab020d6ea311dc0df1519a61092dcb9aee1df8f3e3c8c0d288
-
Filesize
192KB
MD5884fd22d52f3b8656a15eae919f578e4
SHA1ea8d57bae4cd9ef63053a0088fdcb7d662b08eda
SHA256db05735f3bfd23681b3c3c6004f48020a4b9aef5d4e725847f54b97f823b0543
SHA5129c602f47642358b40b3ae06d737d5434aeaf16daf8071d281c1287b67b69f4e3f03c6fd34ba11bb571ee2a20667fad6ffa3578d94c8df3bdb00e2e770a4bbf2e
-
Filesize
86KB
MD54248614b6785e423687edea01f7e084b
SHA106291c3ad21a8b0b77a259f0fbc03418e935dfe9
SHA25649c0befaa68efaa7069d6b120e9244776826267789144d64c40f21e7c9cd3bf5
SHA512ef8c94828ef7d091b4d182b20c79eb33c56a612411922ec44ecedeafaf565c31c694264d07285b646cb9105c75f516e48bec4d7ffd0c23bd2e12b6df53a34186
-
Filesize
324B
MD51b456d88546e29f4f007cd0bf1025703
SHA1e5c444fcfe5baf2ef71c1813afc3f2c1100cab86
SHA256d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb
SHA512c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6
-
Filesize
65KB
MD5387c65b875ba01ee2c7d46da57abb311
SHA195443e5a5c76c40f69df1367aba5207eb1639eef
SHA256d8fa5d96981fdaf3867f68d82330cee8c1fe8853c09905d3f2243cd3bb3ff179
SHA5123fa6f920c1e3eb9661de4b137c0ca1c919a1416f70880806b3df9dc906ba78d97de9a2dacc338d1ebea894c3a92d61f79346e808062d0ac6067fa97b819649dc
-
Filesize
61KB
MD5ba484ee232c6cc418396574b3e5a3525
SHA1775e27418481ade49d15eb0a3d89bfad385944c3
SHA256c93f2995a33661b175e0aafdd1be21820cc76e80a83bd3ca8b71be10615c6b4a
SHA512e2c560de630b3d9aefb060ae2a86c5244a1d5622385c7ad06ecfc2581e3843a9220404dce5b935a1c352a9b846bb29c408738f4e542cdd7271e3a21849997347
-
Filesize
209KB
MD527d5a33bfdcb772b72d780001fd07351
SHA173cabed6dc69bef5985eebcdb4c0c9837c13ecf0
SHA2563e25be32504be70685ccfb233cab4330454e1d32699c3b177a4996336bd58517
SHA512ad50ceee1baf38cc797d97004a5b2fc1ed71d889592e6e1fb4bc0c5c7b89991e1cd2266e68942e4b6483d2ea7205cbea7a665893bb162a2b7be064e3f41c8c42
-
Filesize
19KB
MD5206562eed57e938afe21fc6942fa8e59
SHA1779e90fec866c0fd2f47da020651db71c89ec3dd
SHA25627d611a71edf36307a7ed0651f6c5910292ac7e2b68074a7e33d306b3d93ec45
SHA512275c3192a7aee28fad31beb521cf5e7c66010e7562ce244ba9fc4de352f35b4ab63180ed12a56ea0b1458c185e076e2d07ba6d8797467177d3c5b2ac14371b26
-
Filesize
76KB
MD56fcd109403eb80d7b52c72ea894ad6a5
SHA1a0fdec8217d668012cadb010df98b9d61ee555c9
SHA25620f71e64528d438b439052422ffd53f0ec6b92006f5f7b9946e14fabc8c0c474
SHA512eb365a4e1a6df03dcf92d37803358068749c3f6755b2426b9da3dbc1dc12aa9746eb4978f08e77312c8397a528997e827d022e559b017e85e7abbf0c4d813261