5e03c5b482cf624e3b8532bcc205ede4c37467735d5e4b086d63e9625f9d6801

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
blumfarm_zIdap6He2z.exe
Size 5.4MB
Sample240610-nklyqahe67
SHA256 5e03c5b482cf624e3b8532bcc205ede4c37467735d5e4b086d63e9625f9d6801
MD5 6876bb14fbd914c226eaacedc235f7ba
SHA1 3d6f2a551a9d4cda00771a9a8304f067ebe01dfe
SHA512 57f8b2c88de150bfc28b2e35224c955c97b3ccd906c83ffc97b16f4b9421d8f455054ee88f02a4e5d6a18b9d21f283dd71571a4e7e1be0a038d10ceeb4eb1ea4
SSDEEP 98304:txRl01f8e5bkiTwsqkWProCp2xruPTxskF3dxyPhT835F0WeoDw8rRfJmVhW:PRq1Vki/qcxrCf3dxylj4v
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3320	blumfarm_zIdap6He2z.tmp
1264	passion.exe

Loads dropped DLL 1 IoCs

pid	Process
3320	blumfarm_zIdap6He2z.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 14 IoCs

pid	pid_target	Process	procid_target
2600	1264	WerFault.exe	88
3412	1264	WerFault.exe	88
736	1264	WerFault.exe	88
3340	1264	WerFault.exe	88
2852	1264	WerFault.exe	88
3324	1264	WerFault.exe	88
5080	1264	WerFault.exe	88
536	1264	WerFault.exe	88
3276	1264	WerFault.exe	88
1424	1264	WerFault.exe	88
4244	1264	WerFault.exe	88
4336	1264	WerFault.exe	88
1376	1264	WerFault.exe	88
784	1264	WerFault.exe	88

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
3320	blumfarm_zIdap6He2z.tmp
3320	blumfarm_zIdap6He2z.tmp
1264	passion.exe
1264	passion.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	taskmgr.exe
Token: SeSystemProfilePrivilege	1920	taskmgr.exe
Token: SeCreateGlobalPrivilege	1920	taskmgr.exe
Token: 33	1920	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1920	taskmgr.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
3320	blumfarm_zIdap6He2z.tmp
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 3320	116	blumfarm_zIdap6He2z.exe	82
PID 116 wrote to memory of 3320	116	blumfarm_zIdap6He2z.exe	82
PID 116 wrote to memory of 3320	116	blumfarm_zIdap6He2z.exe	82
PID 3320 wrote to memory of 720	3320	blumfarm_zIdap6He2z.tmp	86
PID 3320 wrote to memory of 720	3320	blumfarm_zIdap6He2z.tmp	86
PID 3320 wrote to memory of 720	3320	blumfarm_zIdap6He2z.tmp	86
PID 3320 wrote to memory of 1264	3320	blumfarm_zIdap6He2z.tmp	88
PID 3320 wrote to memory of 1264	3320	blumfarm_zIdap6He2z.tmp	88
PID 3320 wrote to memory of 1264	3320	blumfarm_zIdap6He2z.tmp	88

C:\Users\Admin\AppData\Local\Temp\blumfarm_zIdap6He2z.exe
"C:\Users\Admin\AppData\Local\Temp\blumfarm_zIdap6He2z.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Users\Admin\AppData\Local\Temp\is-0NIDU.tmp\blumfarm_zIdap6He2z.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0NIDU.tmp\blumfarm_zIdap6He2z.tmp" /SL5="$601E6,5444069,56832,C:\Users\Admin\AppData\Local\Temp\blumfarm_zIdap6He2z.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3320
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Delete /F /TN "Passion_6101"
    3⤵
    PID:720
- - C:\Users\Admin\AppData\Local\Passion\passion.exe
    "C:\Users\Admin\AppData\Local\Passion\passion.exe" a506fee318223a96dc580e651f945bb2
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 868
      4⤵
      Program crash
      PID:2600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 876
      4⤵
      Program crash
      PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 952
      4⤵
      Program crash
      PID:736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1064
      4⤵
      Program crash
      PID:3340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1084
      4⤵
      Program crash
      PID:2852
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1072
      4⤵
      Program crash
      PID:3324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1116
      4⤵
      Program crash
      PID:5080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1284
      4⤵
      Program crash
      PID:536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1292
      4⤵
      Program crash
      PID:3276
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 980
      4⤵
      Program crash
      PID:1424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1276
      4⤵
      Program crash
      PID:4244
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1304
      4⤵
      Program crash
      PID:4336
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1092
      4⤵
      Program crash
      PID:1376
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 1412
      4⤵
      Program crash
      PID:784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1264 -ip 1264
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1264 -ip 1264
1⤵
PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1264 -ip 1264
1⤵
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1264 -ip 1264
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1264 -ip 1264
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1264 -ip 1264
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1264 -ip 1264
1⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1264 -ip 1264
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1264 -ip 1264
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1264 -ip 1264
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1264 -ip 1264
1⤵
PID:1592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1264 -ip 1264
1⤵
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1264 -ip 1264
1⤵
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1264 -ip 1264
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passion.exe

Path C:\Users\Admin\AppData\Local\Passion\passion.exe
Size 3.9MB
SHA256 c5a71486fabf651ba523b942f60f605d06ff09fd941aa0fa71534a9619ddb38b
MD5 8c68e97b9ab15c28977ca4e7798e6934
SHA1 abb680799f321224449ed558a6b706f72300f07a
SHA512 8363c9c5329538585c462614543409b48a8395367bf79c43764ae8e3881301c30496ea51b9bcb369883b3d5956126df41b6bf8b5ed11c7e22e33fedfea255eb5
SSDEEP 49152:t7oxf2YiDRCxFW5DwYL1QG6mKVza34l4feOhlLto2eRFt1nZ5xujF8UZmOfsLJ1c:ts2RUpYL1F6JAuylLY/nZrujFTmOfsE
MD5 SHA1 SHA512 SSDEEP

Submit Download

blumfarm_zIdap6He2z.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-0NIDU.tmp\blumfarm_zIdap6He2z.tmp
Size 694KB
SHA256 3740ec9cc26bdff67d377c254f3edc68e243fd26e512f3491261a67025bd0474
MD5 4ecab4af77f3d3d9cbc112d1c5523838
SHA1 64003fe2ab4b9da1cc371153cffc4b488cdf99d2
SHA512 774475c701f3e3eda1f3791b81268b3857fbcf924f681fbf8161e2135fba52bea5132dc149cfc6f9915d0e753c2a10d129d690a38dd2f1a1377a90f404e79a2c
SSDEEP 12288:bQhCh1/aLmSKrPD37zzH2A6QGgx/bsQeq9KgERkVfzrrNV4blO4/Nat/yxyR:bQYh1yLmSKrPD37zzH2A6QD/InqggE23
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-7M5NN.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

memory/116-73-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/116-2-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/116-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1264-75-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-70-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-71-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-72-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-69-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-128-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-125-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-78-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1264-96-0x0000000000400000-0x0000000000BEE000-memory.dmp

Download

memory/1920-114-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-104-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-105-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-109-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-112-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-111-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-115-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-103-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-113-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/1920-110-0x0000011523E60000-0x0000011523E61000-memory.dmp

Download

memory/3320-6-0x0000000000400000-0x00000000004BD000-memory.dmp

Download

memory/3320-74-0x0000000000400000-0x00000000004BD000-memory.dmp

Download