Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

Setup - Bloxshade.exe

windows7-x64

7

Setup - Bloxshade.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup - Bloxshade.exe

  • Size

    9.0MB

  • MD5

    75b48391fb33a984ac667decca6b0ccd

  • SHA1

    9cb4dea4a8d795369aa298a48910a9d002ad2acb

  • SHA256

    e3b64f3a8630a310186580c84c2a9efa535ef61b06b615e09a54c7c3353f2d26

  • SHA512

    e56708d35922558e95d12ca274a76eb40c1e23347cbe705c44ad82a1d645fb5abe6b718ea8b224008af9103cc79db03c3b656bc00434b52af291f40e8a5e6321

  • SSDEEP

    98304:xbWKo/zVIQsun5MxKkCRrXZu+aV1ZIDHCYYgYM7yn5duKYO4rOiZZeMV61lIeaSS:S+1Z9df4jFVgbaDs8i

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM installer.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM installer.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1500
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM setup.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM setup.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1652
    • C:\Program Files\Bloxshade\setup.exe
      "C:\Program Files\Bloxshade\setup.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Bloxshade\setup.exe
    Filesize

    6.7MB

    MD5

    53c49eb46e609dc60c4d8c2a399f3b44

    SHA1

    c90e831199880f0c1c25ee034329a04ccebd60bf

    SHA256

    8eef87212ca808b830123256be45cc0a800a77507ac9d646d6d656d04243dea6

    SHA512

    e6bde4b7158ec51b609b16b17e4b3acba83c0cf3890274e243392eac84efbfc492380e8f100330ba9b42135e6bc82cefe25f7a51bdfb8b7b9cd61d4532471844

    Download Submit