f2b1f6794cbc7383de4f89f32686ab3bfd47e1d1b6ab25ae319b54e52823a7cb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bloom.exe
Size

693KB
MD5

a6bbe050f468203e8f43cf26b3417dd5
SHA1

0754517312b1b097141655b83cc885077171999e
SHA256

f2b1f6794cbc7383de4f89f32686ab3bfd47e1d1b6ab25ae319b54e52823a7cb
SHA512

b59641496ad42b556cb55dea5874c8c2b94c2238370c197d965365a8250cf16c22c77405b2ac7a615d8edf619db6c90cc7bc421d9747711624e4fa6f495fbadd
SSDEEP

12288:4Mvxtw7/GN42UhBWdd0pwcLp2AKxZm627lqcVDtDOypUJrON2YOFHgU:nvXQnB+Wp3pRKxYl7McVD1Ou7OFV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2392-0-0x0000000140000000-0x00000001401B5000-memory.dmp	upx
behavioral1/memory/2392-3-0x0000000140000000-0x00000001401B5000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2936	WMIC.exe
Token: SeSecurityPrivilege	2936	WMIC.exe
Token: SeTakeOwnershipPrivilege	2936	WMIC.exe
Token: SeLoadDriverPrivilege	2936	WMIC.exe
Token: SeSystemProfilePrivilege	2936	WMIC.exe
Token: SeSystemtimePrivilege	2936	WMIC.exe
Token: SeProfSingleProcessPrivilege	2936	WMIC.exe
Token: SeIncBasePriorityPrivilege	2936	WMIC.exe
Token: SeCreatePagefilePrivilege	2936	WMIC.exe
Token: SeBackupPrivilege	2936	WMIC.exe
Token: SeRestorePrivilege	2936	WMIC.exe
Token: SeShutdownPrivilege	2936	WMIC.exe
Token: SeDebugPrivilege	2936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2936	WMIC.exe
Token: SeRemoteShutdownPrivilege	2936	WMIC.exe
Token: SeUndockPrivilege	2936	WMIC.exe
Token: SeManageVolumePrivilege	2936	WMIC.exe
Token: 33	2936	WMIC.exe
Token: 34	2936	WMIC.exe
Token: 35	2936	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2936	WMIC.exe
Token: SeSecurityPrivilege	2936	WMIC.exe
Token: SeTakeOwnershipPrivilege	2936	WMIC.exe
Token: SeLoadDriverPrivilege	2936	WMIC.exe
Token: SeSystemProfilePrivilege	2936	WMIC.exe
Token: SeSystemtimePrivilege	2936	WMIC.exe
Token: SeProfSingleProcessPrivilege	2936	WMIC.exe
Token: SeIncBasePriorityPrivilege	2936	WMIC.exe
Token: SeCreatePagefilePrivilege	2936	WMIC.exe
Token: SeBackupPrivilege	2936	WMIC.exe
Token: SeRestorePrivilege	2936	WMIC.exe
Token: SeShutdownPrivilege	2936	WMIC.exe
Token: SeDebugPrivilege	2936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2936	WMIC.exe
Token: SeRemoteShutdownPrivilege	2936	WMIC.exe
Token: SeUndockPrivilege	2936	WMIC.exe
Token: SeManageVolumePrivilege	2936	WMIC.exe
Token: 33	2936	WMIC.exe
Token: 34	2936	WMIC.exe
Token: 35	2936	WMIC.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2392	bloom.exe
2392	bloom.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2392	bloom.exe
2392	bloom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	bloom.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1916	2392	bloom.exe	28
PID 2392 wrote to memory of 1916	2392	bloom.exe	28
PID 2392 wrote to memory of 1916	2392	bloom.exe	28
PID 1916 wrote to memory of 2936	1916	cmd.exe	30
PID 1916 wrote to memory of 2936	1916	cmd.exe	30
PID 1916 wrote to memory of 2936	1916	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\bloom.exe
"C:\Users\Admin\AppData\Local\Temp\bloom.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid > "C:\Users\Admin\AppData\Local\Temp\UUID.txt"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2936

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UUID.txt

Filesize
162B

MD5
9d9362fca70310015cd0561d9a9deafc

SHA1
31d83515b7d090a6602e541976086938e5769cc6

SHA256
f78de8ee7109fd3970aa6c014eb01717c55a78c57c7bf1f7a5b898afb13bb13b

SHA512
161790306e40b5b7e957b764b679869ab2d8e104cf8c38321fe4eed98f201a5ca7c168ab59beeddd167257e99958a27011ab6b04cba3f67276544186b3103355

Download Submit
memory/2392-0-0x0000000140000000-0x00000001401B5000-memory.dmp

Filesize
1.7MB

Download
memory/2392-3-0x0000000140000000-0x00000001401B5000-memory.dmp

Filesize
1.7MB

Download