35ae80f3781c2af00531dbdabe71af3003662fc11faad99fd31c30ac3b34627c

Analysis

max time kernel
149s
max time network
143s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
18-03-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blindness/blindness.exe
Size

16.3MB
MD5

bfcedc7b86fff9e36e0889a8b321a3b1
SHA1

b0a6af2ce0580f1d629886ec26b1ffa4eab43d8f
SHA256

df2108aaa31cab9f7b965f7c1652a446693cb529c96ea852869c85e037c438b2
SHA512

0478733da658c4269abe0075c467b6f176cbefd7c4c188ef66c6d959dc5443ed94fa182e705b67682f33254c43f3e745e6b2cec2f877fade1f3f1ef3e4f6f5e6
SSDEEP

393216:y3Z8A06vEQ3ITvzx46SxiILGREuV3WjRI85:y3ZIzx46YNL6W9Ie

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\KERNEL32.DLL	blindness.exe
File opened for modification	C:\Windows\System32\GDI32.dll	blindness.exe
File opened for modification	C:\Windows\System32\sechost.dll	blindness.exe
File opened for modification	C:\Windows\System32\kernel.appcore.dll	blindness.exe
File opened for modification	C:\Windows\System32\powrprof.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	blindness.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	blindness.exe
File opened for modification	C:\Windows\System32\RPCRT4.dll	blindness.exe
File opened for modification	C:\Windows\System32\profapi.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	blindness.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	blindness.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	blindness.exe
File opened for modification	C:\Windows\System32\imm32.dll	blindness.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	blindness.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	blindness.exe
File opened for modification	C:\Windows\System32\user32.dll	blindness.exe
File opened for modification	C:\Windows\System32\shell32.dll	blindness.exe
File opened for modification	C:\Windows\System32\shcore.dll	blindness.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\WINMMBASE.dll	blindness.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	blindness.exe
File opened for modification	C:\Windows\System32\combase.dll	blindness.exe
File opened for modification	C:\Windows\System32\advapi32.dll	blindness.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	blindness.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	blindness.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	blindness.exe
File opened for modification	C:\Windows\System32\win32u.dll	blindness.exe
File opened for modification	C:\Windows\System32\cfgmgr32.dll	blindness.exe
File opened for modification	C:\Windows\System32\ole32.dll	blindness.exe
File opened for modification	C:\Windows\System32\psapi.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	blindness.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	blindness.exe
File opened for modification	C:\Windows\System32\windows.storage.dll	blindness.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	blindness.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	blindness.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_108e4f62dfe5d999\comctl32.dll	blindness.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	blindness.exe
Token: SeTcbPrivilege	4664	blindness.exe
Token: SeTcbPrivilege	4664	blindness.exe
Token: SeLoadDriverPrivilege	4664	blindness.exe
Token: SeCreateGlobalPrivilege	4664	blindness.exe
Token: SeLockMemoryPrivilege	4664	blindness.exe
Token: 33	4664	blindness.exe
Token: SeSecurityPrivilege	4664	blindness.exe
Token: SeTakeOwnershipPrivilege	4664	blindness.exe
Token: SeManageVolumePrivilege	4664	blindness.exe
Token: SeBackupPrivilege	4664	blindness.exe
Token: SeCreatePagefilePrivilege	4664	blindness.exe
Token: SeShutdownPrivilege	4664	blindness.exe
Token: SeRestorePrivilege	4664	blindness.exe
Token: 33	4664	blindness.exe
Token: SeIncBasePriorityPrivilege	4664	blindness.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe
4664	blindness.exe

C:\Users\Admin\AppData\Local\Temp\Blindness\blindness.exe
"C:\Users\Admin\AppData\Local\Temp\Blindness\blindness.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4664-1-0x000000000DB70000-0x000000000DB71000-memory.dmp

Filesize
4KB

Download
memory/4664-0-0x000000000DB70000-0x000000000DB71000-memory.dmp

Filesize
4KB

Download
memory/4664-3-0x0000000007D70000-0x0000000007D71000-memory.dmp

Filesize
4KB

Download
memory/4664-5-0x0000000007D80000-0x0000000007D81000-memory.dmp

Filesize
4KB

Download
memory/4664-7-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Filesize
4KB

Download
memory/4664-9-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/4664-13-0x0000000007DB0000-0x0000000007DB1000-memory.dmp

Filesize
4KB

Download
memory/4664-15-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/4664-17-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download
memory/4664-19-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Filesize
4KB

Download