hxxps://eprst281[.]boo/files/blackrock[.]msix

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://eprst281.boo/files/blackrock.msix

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5490C51-07F3-11EF-972F-E61A8C993A67} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000bff9b493174251a2844458f24f623e84425647dedc568c1eb48f91a90d44940c000000000e80000000020000200000002c048655fc5aeacbfe5aff31de82990986eeb6c65583e1c571a3f2a81fe6f0012000000000528a72f1b55f18a56a1a7d417e550e5dca93fb5b808aff2036ca894c325a8e400000007273888ad0c0eb3dc5697a107a234c1f1a189b4353f8f364520e78eaafa36e248e696730ad5e7423a2834b47652b63c1b47a63ec2751691cfabe61b2af03e6d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6073e181009cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420754735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000957e05b6bc087b6514d6391afbb67dcb37f9f9ddecdb23345d55c679ec2d6e21000000000e8000000002000020000000f3d2d265f33bf8425c7918d5e171399ff0d536186367615ea41c6a01cfc6f6f79000000047d4612b5ac397a52f786be62b5521d0f80d036ac400270776b28bea3cb389749302cfc9e21de68d97f460efe8290155156da249c99c1e6cee0448d9a85c2a92a87785ce8af121917eb41fef3341524b3e09bf149088db18c8aa8772fbb15d62e2a0f24a06b97033362949c9a04d7313109ff3e00d7c0d428557d7d4848993309ebeeea994b6f7bf48605b2a44ed461e4000000026fa60443b7468a9d35d398be43037b1bb4148008a57a767af06feef893ecd860ec577d5a3bcb0a44c667d9c81e2a5df954192951e0273d907113edbac9476af	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28
PID 2384 wrote to memory of 2364	2384	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://eprst281.boo/files/blackrock.msix
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eceb4a938250cc12095126cf8325ba6d

SHA1
0d288f8be66a7108c6d7f155783284634463d984

SHA256
4417228461f0beca8bdd2f70591ffc50c44c7921f6435a298bd3ca382e81423e

SHA512
1e729647f9b10a45b857ea0fec9687148309889b811d47c7f17eb31927a0f5cc0676a590d91320d3c423d4ecbf93134531d58f9e0056519cfddfbc2dd1e7846f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
937a5b2f34b83e83a6b7268531853c48

SHA1
e96265c5ed2c8bad114d3edcd54fe039faf5b5b9

SHA256
27479b7b658f561ae55d58168789c486e41852934063adada9ddbe595a829048

SHA512
81c26192c498eb1e453925465ee2db4131262a16b308e89f3dfb4cdd29e3e52d52d99098805d8db11897dec961b43f1c51ee2ecce122b8910d248ce8f97f6667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
053fc191553d8a7821c7dffc4ebd086c

SHA1
96b9354a40ab50ec94d3ad4a342a399a7e5b1b0d

SHA256
62f3998d3be5a3339c40e045ac537f9dbd3605a813578ef2968ce79c7a1df297

SHA512
f6d4010cfe482ae49cd89a32ab3b5ab9d146bc68c9d03db6ff5624a623716f97b9a489fce911825eda7ceb0c2d78858c9b45052a7b68ff9af83b5b641976a6e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8587a931cfc1b1051251319316c9e003

SHA1
f2e7cba3eeb2efa0141fb524ad4ff40d6f95a748

SHA256
c2c1c2deaa7396248b8e7179480e9e90aeae585fe83cb69ebfcf00deb88dfd5a

SHA512
9c45edbd525715e2492dd78938e5652e79930f0b71eb5c84e97eb1c240bfa58ce6b26ee82b02b1c1f3597f21910337d53f2a2f009bb8c70439c06cf8c9c82c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e7f7138ccbea38f725590b3e427ec75

SHA1
8dd8911a3c3ce86275a7486357c76c46ca3891c6

SHA256
0ebd43c669d806cb2600754a75d13a0aff9ce117eb1ccb1a876cef8c593463e4

SHA512
4e83c8a76457f38a5d50d037a673df06d6ed76c80132e5f9ff3787fdc57575c324928bbc22f6375b9a3274f52425b4977fe4dcc241987b9157dfebe730316002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
761a3881d020b328c2700a5b7a7e4b78

SHA1
e9538f37911afc1fb46ae22648556d712bd85530

SHA256
a85d68f21823d63a77c672afb08c924f064cb8b198b93a6b37b918b8a66578f4

SHA512
2de264c3aca52e18c67072f366d01c0554080b882c4e1185c67592f078592aa8d820b057cd7ffff70f66b62987b7a65e44b2b84d1a00452482e784d62eeaea49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17d5ca193ce53155cecd627d0e6474e6

SHA1
f04eae729a2bea957b13416049f2de6696b60f02

SHA256
8f38deba1e7248ccacd1d0337095010dacedc8c10c91e7ca2d7d134853f53734

SHA512
dfc4def25f6d41e04ad05af3923fb3eb39aa6ec8d40cea3627ef985e5e3c1b046ca21857339c2aa3c2e20507436c7af0de2e81151a4e2706ef827e48da24c281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cfc867592090cf21a0edeba339c872c

SHA1
cc37e51e0140391d533796027496d55ce7aa060e

SHA256
44409850ec387931edbcc3a728d2e46c6ad57f600235149cf9c653b550d2b248

SHA512
e62398bcf6f052bc9ab2c48a23b68df1ec04f2f140d5be8ccbd315df19b4bd58056275a84a19db84de46d29b4e58869185305b23ba54b4fdaea5b3b893084a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ce411985a1aac0e733c145d3a144d50

SHA1
373a5780caafaaf674639e2400d11cb62e6fd8b1

SHA256
145074eed96dd7b9c15282f20627c69d794d1391064e34d57018cbc2e67ba9ec

SHA512
119ccb21b70fc55a059bdceeb4b64157942e74c0ed3fb2f160412b11352f72e2719029e88db2aa0adb723d23f1206cd12de1422b324654371f5f8c2a30f66731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb4e15cdb098cac61bec345c04fda8d9

SHA1
5020e778ceaec439deeb13a875fa46b33fd46fd4

SHA256
1dcd70d9fd222d9fc3ce0b0d49c9f8f2cf804c60063cb43f4e68a47f6666f5ef

SHA512
46c5b835f90934eb0bd4c82fd90849bdfee1b25e79f54a865e876ce9b629ef69999dd2e314a4a6a9d989baca4ee9758a96b28571472284dc1e2baa2d79907794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb865247176f69ad2eecfe123740f44

SHA1
a7ee11a62307ebd1d51ccf13dfd610f9ccfbd403

SHA256
e4f012d145b4782f3ce68e1793934bc47d33fc65c9608a11b15f4ef9979eaf58

SHA512
2e933bb0ba5046129f3ca90c21c6931a23b4ae6d59d6bfa09be7b014bcc4aa2e335121e76cbeea853794d9cfeef83ada3f6e8a0150bbe26a17160b8e230a8bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3baccf73b13349d5b922a4bd99820c

SHA1
0d30e4134780aa45b4251c61a8cefbf2688a17d4

SHA256
269ca8c3a82a3e4a15479b3554c8ec8f428619a33a0c3a863a62045357e2268f

SHA512
5b08dcb24a0e10fc488e5ab8db02f2e6173922d023fd72afcfca028f2b5f28dc6facbeea990abaad1ed2741c9575f20522d1e015b24da6b623a132bb4ace9d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
72052b1eddb982021335d01361c56c75

SHA1
507440c92d25dc43ca9a4977bb18ae6c017f570e

SHA256
0042a7b5e4e213b315ed4254ed3a2f497f5ecd3d8918f92eb82677d2b1d2571e

SHA512
8f8bfb0eed75c2ae6124c7c69d978435af93af8bafec6837d0e0ceb87e1306f1519802b1407d3c84145d4eb258eb6df2796843ab9373424bf16c37a8863455b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df09c8c0e8c94c305c251d0a01639440

SHA1
b254bd0f12b10f4bc17e89fe6f37ce83165b5cd0

SHA256
8de5b1c7b8bcb61815b9bbbf6997f3dbf97a171f39f0ce2bd2892a9ee851f35d

SHA512
6a14fa56f34ecbe13191e15fbc947055f09c97715e1bcf1c40a0fec422fb7b9cb7b95c4dda984984a9cd7017d4e4ee8ada7451b7e6ae16ac6072050009cb5b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8047e17f0683e66549630a40b9d1a6e6

SHA1
f4a329c3216b9b1875bdced73f284421ceb30a8c

SHA256
f3d319c68d20736aa76c20dc91671d5ab361d0fb4e2dd75b328eeebd719a7916

SHA512
85306ab1d3bd5692b0d20099c9595b19b9d20aa5ac09348618234cb9c6ca01777f0d785bcca4bf871e3172c0340c8c247dd1b4a5fbaf6ac410af24c864ae4940

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69CC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab76AB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar76C0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit