Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
WinlockerVB6Blacksod.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
WinlockerVB6Blacksod.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
WinlockerVB6Blacksod.exe
-
Size
2.4MB
-
MD5
dbfbf254cfb84d991ac3860105d66fc6
-
SHA1
893110d8c8451565caa591ddfccf92869f96c242
-
SHA256
68b0e1932f3b4439865be848c2d592d5174dbdbaab8f66104a0e5b28c928ee0c
-
SHA512
5e9ccdf52ebdb548c3fa22f22dd584e9a603ca1163a622db5707dbcc5d01e4835879dcfd28cb1589cbb25aed00f352f7a0a0962b1f38b68fc7d6693375e7666d
-
SSDEEP
49152:6kAG2QGTC5xvMdgpdb1KRHGepUu2cGbqPs9+q2HRPTnFVSLE:6kAjQGTCnvMmpYQqPNRPTnF4Y
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe" msiexec.exe -
Loads dropped DLL 15 IoCs
pid Process 2036 WinlockerVB6Blacksod.exe 2036 WinlockerVB6Blacksod.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2652 MsiExec.exe 2904 MsiExec.exe 2652 MsiExec.exe 2036 WinlockerVB6Blacksod.exe 2652 MsiExec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 4 2652 MsiExec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: WinlockerVB6Blacksod.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: WinlockerVB6Blacksod.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\R: WinlockerVB6Blacksod.exe File opened (read-only) \??\S: WinlockerVB6Blacksod.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: WinlockerVB6Blacksod.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: WinlockerVB6Blacksod.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\L: WinlockerVB6Blacksod.exe File opened (read-only) \??\Q: WinlockerVB6Blacksod.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\H: WinlockerVB6Blacksod.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: WinlockerVB6Blacksod.exe File opened (read-only) \??\W: WinlockerVB6Blacksod.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: WinlockerVB6Blacksod.exe File opened (read-only) \??\O: WinlockerVB6Blacksod.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: WinlockerVB6Blacksod.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: WinlockerVB6Blacksod.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: WinlockerVB6Blacksod.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: WinlockerVB6Blacksod.exe File opened (read-only) \??\X: WinlockerVB6Blacksod.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: WinlockerVB6Blacksod.exe File opened (read-only) \??\Y: WinlockerVB6Blacksod.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe msiexec.exe File created C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav msiexec.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\Installer\f761130.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI11CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1319.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI14C1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI153F.tmp msiexec.exe File opened for modification C:\Windows\Installer\f761133.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI12D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI14A1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI16CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1269.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI12A9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI14A0.tmp msiexec.exe File created C:\Windows\Tasks\sys.job MsiExec.exe File opened for modification C:\Windows\Installer\f761130.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1299.tmp msiexec.exe File created C:\Windows\Installer\f761133.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI158F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI165A.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2804 msiexec.exe 2804 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2804 msiexec.exe Token: SeTakeOwnershipPrivilege 2804 msiexec.exe Token: SeSecurityPrivilege 2804 msiexec.exe Token: SeCreateTokenPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeAssignPrimaryTokenPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeLockMemoryPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeIncreaseQuotaPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeMachineAccountPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeTcbPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeSecurityPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeTakeOwnershipPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeLoadDriverPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeSystemProfilePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeSystemtimePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeProfSingleProcessPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeIncBasePriorityPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeCreatePagefilePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeCreatePermanentPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeBackupPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeRestorePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeShutdownPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeDebugPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeAuditPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeSystemEnvironmentPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeChangeNotifyPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeRemoteShutdownPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeUndockPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeSyncAgentPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeEnableDelegationPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeManageVolumePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeImpersonatePrivilege 2036 WinlockerVB6Blacksod.exe Token: SeCreateGlobalPrivilege 2036 WinlockerVB6Blacksod.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2792 msiexec.exe Token: SeLockMemoryPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeMachineAccountPrivilege 2792 msiexec.exe Token: SeTcbPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeLoadDriverPrivilege 2792 msiexec.exe Token: SeSystemProfilePrivilege 2792 msiexec.exe Token: SeSystemtimePrivilege 2792 msiexec.exe Token: SeProfSingleProcessPrivilege 2792 msiexec.exe Token: SeIncBasePriorityPrivilege 2792 msiexec.exe Token: SeCreatePagefilePrivilege 2792 msiexec.exe Token: SeCreatePermanentPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeDebugPrivilege 2792 msiexec.exe Token: SeAuditPrivilege 2792 msiexec.exe Token: SeSystemEnvironmentPrivilege 2792 msiexec.exe Token: SeChangeNotifyPrivilege 2792 msiexec.exe Token: SeRemoteShutdownPrivilege 2792 msiexec.exe Token: SeUndockPrivilege 2792 msiexec.exe Token: SeSyncAgentPrivilege 2792 msiexec.exe Token: SeEnableDelegationPrivilege 2792 msiexec.exe Token: SeManageVolumePrivilege 2792 msiexec.exe Token: SeImpersonatePrivilege 2792 msiexec.exe Token: SeCreateGlobalPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2804 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2792 msiexec.exe 2792 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2036 wrote to memory of 2792 2036 WinlockerVB6Blacksod.exe 29 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2652 2804 msiexec.exe 30 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31 PID 2804 wrote to memory of 2904 2804 msiexec.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe"C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56D09F812905249C8EDC8181963271322⤵
- Loads dropped DLL
- Blocklisted process makes network request
PID:2652
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99C3E912530F43AAB6767A6634352491 M Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5e492e2145fb1bc153c398be12a7fa797
SHA1fedc690eb580343ff47cd9d8b573ca5276f7ae99
SHA2562607c1d190c8e3a082be1bb4870fa552323a72e254053e55ac5cd35478fba19f
SHA5127e0a48b3f4f1323369825d9786ec0a4142931f5dadab8005fb41094e91dc288a051ccdefa0033643d18f0b39ef8cc4118133ecb69899792793ad71930df63a30
-
Filesize
84B
MD58e7cff98f1ae0094886b5605e0873ae5
SHA146e2dbc13192f5ce8b758ab930984d72fab5739f
SHA25690d3c7a9dc73b4f4d55bd171639280640b7fb20871d5550e15c46cd50ea92a9e
SHA512fb3f7b91727be174f2a51e53e4904c439930148e9d888d78da98264fe73c65f274e15b0ffacaf9f0757b6f4c10a2df70708fe3d5c351ab3d5fb1c81f02cb99cb
-
Filesize
84B
MD5e7d3132b8f0fdab13a4b0ded05c568cd
SHA1925960066d06b9c460becbcc8d8db4a625cfc531
SHA256f48c793de5abea3d0ce2b2144a24e688687f403c974aa5ccf80cd1daf40a89a2
SHA5123285600a8c446c522c46a860863901d5039be346b0bd5c0398e4bff05f85c3f64eae88d0fc83e6cd9235a3df96b2bb613b9c3d056695b346af0dc4de7c2cbb82
-
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{BF9ACAA8-426C-4FC8-B7FA-B97A1B7C4DE8}.session
Filesize4KB
MD5e9b2798fda65e57d038004841b99b48a
SHA129b2bd66e5c973c0db2a83a9cacf8500bfe6da29
SHA25644a51d5a26cf41ef50deb069f526424fa1aecccc17bc1deafd3a5c1a3cb41367
SHA512b98b8f90659ab7eb4e4302af372b86519dd4fe2091502e1bba493b94bcc09e3d620409f9a17b535995e705bef9a476d895474d38841731cba17821c1a1b825ab
-
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi
Filesize1010KB
MD527bc9540828c59e1ca1997cf04f6c467
SHA1bfa6d1ce9d4df8beba2bedf59f86a698de0215f3
SHA25605c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a
SHA512a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848
-
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav
Filesize724KB
MD5bab1293f4cf987216af8051acddaf97f
SHA100abe5cfb050b4276c3dd2426e883cd9e1cde683
SHA256bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344
SHA5123b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49
-
Filesize
24KB
MD5e579c5b3c386262e3dd4150eb2b13898
SHA15ab7b37956511ea618bf8552abc88f8e652827d3
SHA256e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2
SHA5129cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb
-
Filesize
180KB
MD5d552dd4108b5665d306b4a8bd6083dde
SHA1dae55ccba7adb6690b27fa9623eeeed7a57f8da1
SHA256a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5
SHA512e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969
-
Filesize
88KB
MD54083cb0f45a747d8e8ab0d3e060616f2
SHA1dcec8efa7a15fa432af2ea0445c4b346fef2a4d6
SHA256252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a
SHA51226f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133
-
Filesize
96KB
MD53cab78d0dc84883be2335788d387601e
SHA114745df9595f190008c7e5c190660361f998d824
SHA256604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd
SHA512df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820
-
Filesize
128KB
MD57e6b88f7bb59ec4573711255f60656b5
SHA15e7a159825a2d2cb263a161e247e9db93454d4f6
SHA25659ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f
SHA512294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c
-
Filesize
312KB
MD5aa82345a8f360804ea1d8d935f0377aa
SHA1c09cf3b1666d9192fa524c801bb2e3542c0840e2
SHA2569c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437
SHA512c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db
-
Filesize
126KB
MD53531cf7755b16d38d5e9e3c43280e7d2
SHA119981b17ae35b6e9a0007551e69d3e50aa1afffe
SHA25676133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089
SHA5127b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd