e3b64f3a8630a310186580c84c2a9efa535ef61b06b615e09a54c7c3353f2d26

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 02:45

Target

Setup - Bloxshade.exe
Size

9.0MB
MD5

75b48391fb33a984ac667decca6b0ccd
SHA1

9cb4dea4a8d795369aa298a48910a9d002ad2acb
SHA256

e3b64f3a8630a310186580c84c2a9efa535ef61b06b615e09a54c7c3353f2d26
SHA512

e56708d35922558e95d12ca274a76eb40c1e23347cbe705c44ad82a1d645fb5abe6b718ea8b224008af9103cc79db03c3b656bc00434b52af291f40e8a5e6321
SSDEEP

98304:xbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaSS:S+1Z9df4jFVgbaDs8i

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2748	setup.exe

Loads dropped DLL 2 IoCs

pid	Process
1684	Setup - Bloxshade.exe
1684	Setup - Bloxshade.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Bloxshade\setup.exe	Setup - Bloxshade.exe
File created	C:\Program Files\Bloxshade\installer.exe	Setup - Bloxshade.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1148	taskkill.exe
1320	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3056	1684	Setup - Bloxshade.exe	28
PID 1684 wrote to memory of 3056	1684	Setup - Bloxshade.exe	28
PID 1684 wrote to memory of 3056	1684	Setup - Bloxshade.exe	28
PID 3056 wrote to memory of 1148	3056	cmd.exe	30
PID 3056 wrote to memory of 1148	3056	cmd.exe	30
PID 3056 wrote to memory of 1148	3056	cmd.exe	30
PID 1684 wrote to memory of 2600	1684	Setup - Bloxshade.exe	32
PID 1684 wrote to memory of 2600	1684	Setup - Bloxshade.exe	32
PID 1684 wrote to memory of 2600	1684	Setup - Bloxshade.exe	32
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 1684 wrote to memory of 2748	1684	Setup - Bloxshade.exe	35
PID 1684 wrote to memory of 2748	1684	Setup - Bloxshade.exe	35
PID 1684 wrote to memory of 2748	1684	Setup - Bloxshade.exe	35

C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe
"C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM installer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM installer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM setup.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM setup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Program Files\Bloxshade\setup.exe
  "C:\Program Files\Bloxshade\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2748

\Program Files\Bloxshade\setup.exe

Filesize
6.7MB

MD5
53c49eb46e609dc60c4d8c2a399f3b44

SHA1
c90e831199880f0c1c25ee034329a04ccebd60bf

SHA256
8eef87212ca808b830123256be45cc0a800a77507ac9d646d6d656d04243dea6

SHA512
e6bde4b7158ec51b609b16b17e4b3acba83c0cf3890274e243392eac84efbfc492380e8f100330ba9b42135e6bc82cefe25f7a51bdfb8b7b9cd61d4532471844

Download Submit