ac0b5bdc22a01e9d28677de46021d99f64297e598eb20c4406ffde5d85521b35

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 09:33

Target

Setup - Bloxshade.exe
Size

9.3MB
MD5

f624c04cbf7a9e8f334ab2bb34b1a768
SHA1

58f36ccf34cade7f45138176dac97a82cbd03d62
SHA256

1f87570fc2bcd3df9086ef32e22299bd682b0b8269db77f5fa9452a046c4b7d8
SHA512

90b6966b55829019eea33c2722669ca2ffcc9cc1a153e1d78ad081a5ba018f1b737e43695fe481c6a4e6b97ebdaf8c88de9a1ef1f41c4e867456f396d85028d9
SSDEEP

98304:s9gtT1PiZU9sjOH1cyrOijrwS+A5OKTilSaXMnvSk:s9gMJOHnj5+AkSilV8v/

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2752	setup.exe

Loads dropped DLL 2 IoCs

pid	Process
1576	Setup - Bloxshade.exe
1576	Setup - Bloxshade.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Bloxshade\setup.exe	Setup - Bloxshade.exe
File created	C:\Program Files\Bloxshade\installer.exe	Setup - Bloxshade.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1244	taskkill.exe
1320	taskkill.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 3056	1576	Setup - Bloxshade.exe	28
PID 1576 wrote to memory of 3056	1576	Setup - Bloxshade.exe	28
PID 1576 wrote to memory of 3056	1576	Setup - Bloxshade.exe	28
PID 3056 wrote to memory of 1244	3056	cmd.exe	30
PID 3056 wrote to memory of 1244	3056	cmd.exe	30
PID 3056 wrote to memory of 1244	3056	cmd.exe	30
PID 1576 wrote to memory of 2600	1576	Setup - Bloxshade.exe	32
PID 1576 wrote to memory of 2600	1576	Setup - Bloxshade.exe	32
PID 1576 wrote to memory of 2600	1576	Setup - Bloxshade.exe	32
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 2600 wrote to memory of 1320	2600	cmd.exe	34
PID 1576 wrote to memory of 2752	1576	Setup - Bloxshade.exe	35
PID 1576 wrote to memory of 2752	1576	Setup - Bloxshade.exe	35
PID 1576 wrote to memory of 2752	1576	Setup - Bloxshade.exe	35

C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe
"C:\Users\Admin\AppData\Local\Temp\Setup - Bloxshade.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM installer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM installer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM setup.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM setup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- C:\Program Files\Bloxshade\setup.exe
  "C:\Program Files\Bloxshade\setup.exe"
  2⤵
  - Executes dropped EXE
  PID:2752

\Program Files\Bloxshade\setup.exe

Filesize
6.6MB

MD5
0e6bb6e2181c583bdd2f85787d4de172

SHA1
b17c709701160556890e59602f18c4460d8fc1b2

SHA256
4603a8753118fb2f77a45176941983ed2a0e6dada0dbead8479cc9e430575afc

SHA512
7693eb8cfd64045e4f85cb9c7aa17cee60a5ee8ce43360b83ce0318459ef32241070b8939a1cfe2aa995cef54f2be6ae7d6e814c6da243abc553b42f6675c568

Download Submit