Overview

overview

6

Static

static

1

BlueStacks...2).exe

windows10-1703-x64

6

BlueStacks...2).exe

windows7-x64

6

BlueStacks...2).exe

windows10-2004-x64

6

BlueStacks...2).exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    97s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/06/2024, 20:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BlueStacks10Installer_10.20.0.1005_native_a0e0155c7e586ffd8134dd53396d0ee7_MDs1LDM7MTUsMTsxNSw0OzE1 - Copy (2).exe

  • Size

    910KB

  • MD5

    80ff5d3b21f79bef9376b9a8867167da

  • SHA1

    9f282460ebc7297939c8f8dc0daa667e18a45d0a

  • SHA256

    1e6004b45a0f41da07ca7e3cfe7530ebddaebfad05c13023ca16cef94b9265a0

  • SHA512

    4c12153afa3ad66ab2cb6fdcd11ff868eead53f879b06c3f05fe9c5196c8c47b90206a5f88571783ecc203495738fc48508f8bcc679d0e82f9536556c58ba9b2

  • SSDEEP

    12288:CivtCXQd0gjKX7zuqGKcD779TxgE98I17YpNgc8gJ67yY9lAFmNek7ra8MDVFnKg:CivtCXWeGKc9Txt9Okc/WmSrLbLvhYh

Score
6/10
discoveryevasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.20.0.1005_native_a0e0155c7e586ffd8134dd53396d0ee7_MDs1LDM7MTUsMTsxNSw0OzE1 - Copy (2).exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.20.0.1005_native_a0e0155c7e586ffd8134dd53396d0ee7_MDs1LDM7MTUsMTsxNSw0OzE1 - Copy (2).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        PID:4816
      • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        PID:1116
      • C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.21.0.1043_nxt.exe
        "C:\Users\Admin\AppData\Local\BlueStacksSetup\BSX-Setup-5.21.0.1043_nxt.exe" -s
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\BlueStacks X\green.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1456
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c green.bat
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="BlueStacksWeb"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4620
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name="Cloud Game"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2604
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="BlueStacksWeb" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\BlueStacksWeb.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1996
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall add rule name="Cloud Game" dir=in action=allow program="C:\Program Files (x86)\BlueStacks X\Cloud Game.exe"
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:4332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\BlueStacks X\BlueStacks X.exe
    Filesize

    476KB

    MD5

    39db156605dab8cd45d95f8a0fb2f2ce

    SHA1

    cf5d7da04e3a8fcaeb01a8fd5a4bb429a5a9e867

    SHA256

    1fb66df3c63548eea54248be41f4c7e133f248bb81a808b04e898eb962bc3bf0

    SHA512

    cd54517766f990f3159e7042f34c625b0733b961b7f3ea07f72abf10d5c8cf3838a25a30d81397472bf6d07b60f68c219126c0394f7fbb36d0da832e622bb545

    Download Submit

  • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_disabled.svg
    Filesize

    569B

    MD5

    e7fdf6a9c8cae1fc1108dc5a803a1905

    SHA1

    2853f9ff5e63685ebb1449dcf693176b17e4ab60

    SHA256

    8ee5aa84139b2ea5549f7272523aeb203d73954c5ccdcf6f7407bf1a3469f13e

    SHA512

    a6388b24926934e20ccf7fcab41bd219dc6c0053428481d7f466bf89f26bf1a36fdff716a9ddd9ab268df73b04dff1449c6bac1f5c707e31ae2ee71c2087e0d9

    Download Submit

  • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_hover.svg
    Filesize

    653B

    MD5

    76166804e6ce35e8a0c92917b8abc071

    SHA1

    8bd38726a11a9633ac937b9c6f205ce5d36348b0

    SHA256

    1bca2e912184b8168ee8961de68d1d839f4f9827fde6f48ab100fb61e82eff90

    SHA512

    93c4f1af7e9f89091a207ab308e05ddd4c92406c039f7465d3b8aca7e0cc7a6c922a22e1eee2f5c88db5e89016ef69294b2a0905d7d6a90fd32835bc11929005

    Download Submit

  • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_normal.svg
    Filesize

    569B

    MD5

    3221ac69d7facd8aa90ffa15aea991b0

    SHA1

    e0571f30f4708ec78addc726a743679ca0f05e45

    SHA256

    92aeae68e9e0973d9e0dc575941f1cb2e24afd0574341a46b870be7384eaa537

    SHA512

    5e2de0abfe60a4db16ea5e8739260c19962fbfc60869a77bde6ab3547ad8ee3ad88e74e97da31fa23be096afddad018e431d152d6d0fa21a75357a11dacb1328

    Download Submit

  • C:\Program Files (x86)\BlueStacks X\image\LocalAPK\close_pressed.svg
    Filesize

    653B

    MD5

    dfddf8d0788988c3e48fcbfb2a76cd20

    SHA1

    463bb61f0012289e860c32f1885a3a8f57467f2e

    SHA256

    9585f41eb6202e89f2087266fa31852d7f41ca8cc659b907c96753fe165f937d

    SHA512

    e708c5114c60f7574589d6a56c9faedda26ee4a40f0eeb25f5e12eadcf790f24fdbf393fa0aa6ad449b5337d625b092d6f8822472fa8a6ce1339aca59c50c3ca

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\backicon.png
    Filesize

    15KB

    MD5

    7ff5dc8270b5fa7ef6c4a1420bd67a7f

    SHA1

    b224300372feaa97d882ca2552b227c0f2ef4e3e

    SHA256

    fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

    SHA512

    f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\close_red.png
    Filesize

    15KB

    MD5

    93216b2f9d66d423b3e1311c0573332d

    SHA1

    5efaebec5f20f91f164f80d1e36f98c9ddaff805

    SHA256

    d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

    SHA512

    922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\custom.png
    Filesize

    17KB

    MD5

    03b17f0b1c067826b0fcc6746cced2cb

    SHA1

    e07e4434e10df4d6c81b55fceb6eca2281362477

    SHA256

    fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

    SHA512

    67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\installer_bg.jpg
    Filesize

    78KB

    MD5

    3478e24ba1dd52c80a0ff0d43828b6b5

    SHA1

    b5b13bbf3fb645efb81d3562296599e76a2abac0

    SHA256

    4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

    SHA512

    5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\installer_logo.png
    Filesize

    14KB

    MD5

    e33432b5d6dafb8b58f161cf38b8f177

    SHA1

    d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

    SHA256

    9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

    SHA512

    520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\installer_minimize.png
    Filesize

    113B

    MD5

    38b539a1e4229738e5c196eedb4eb225

    SHA1

    f027b08dce77c47aaed75a28a2fce218ff8c936c

    SHA256

    a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

    SHA512

    2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\loader.png
    Filesize

    279B

    MD5

    03903fd42ed2ee3cb014f0f3b410bcb4

    SHA1

    762a95240607fe8a304867a46bc2d677f494f5c2

    SHA256

    076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

    SHA512

    8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\setpath.png
    Filesize

    15KB

    MD5

    b2e7f40179744c74fded932e829cb12a

    SHA1

    a0059ab8158a497d2cf583a292b13f87326ec3f0

    SHA256

    5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

    SHA512

    b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Assets\unchecked_gray.png
    Filesize

    192B

    MD5

    e50df2a0768f7fc4c3fe8d784564fea3

    SHA1

    d1fc4db50fe8e534019eb7ce70a61fd4c954621a

    SHA256

    671f26795b12008fbea1943143f660095f3dca5d925f67d765e2352fd7ee2396

    SHA512

    c87a8308a73b17cbdd179737631fb1ba7fdaeb65e82263f6617727519b70a81266bb695867b9e599c1306ee2cf0de525452f77ce367ca89bf870ea3ae7189998

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\BlueStacksInstaller.exe
    Filesize

    623KB

    MD5

    cc041375a535f92ecaeda1672b5677da

    SHA1

    ef38cc04d88f8070af259567b108ac031fca7614

    SHA256

    ea1e6c9644acc3611928c221cb9669fb99dbbda3a55a6a7fb819f6e52e4c538c

    SHA512

    2949c50a70fb5f87c8f809f96d4dc3c600515b000feaf38b9e7dd132936024aa7d14aef3183b666cb8ddf947ee8d5ac5ea555cb211c685d88657995333284b16

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\BlueStacksInstaller.exe.config
    Filesize

    324B

    MD5

    1b456d88546e29f4f007cd0bf1025703

    SHA1

    e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

    SHA256

    d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

    SHA512

    c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\HD-CheckCpu.exe
    Filesize

    200KB

    MD5

    81234fd9895897b8d1f5e6772a1b38d0

    SHA1

    80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

    SHA256

    2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

    SHA512

    4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\JSON.dll
    Filesize

    411KB

    MD5

    f5fd966e29f5c359f78cb61a571d1be4

    SHA1

    a55e7ed593b4bc7a77586da0f1223cfd9d51a233

    SHA256

    d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

    SHA512

    d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\Locales\i18n.en-US.txt
    Filesize

    19KB

    MD5

    206562eed57e938afe21fc6942fa8e59

    SHA1

    779e90fec866c0fd2f47da020651db71c89ec3dd

    SHA256

    27d611a71edf36307a7ed0651f6c5910292ac7e2b68074a7e33d306b3d93ec45

    SHA512

    275c3192a7aee28fad31beb521cf5e7c66010e7562ce244ba9fc4de352f35b4ab63180ed12a56ea0b1458c185e076e2d07ba6d8797467177d3c5b2ac14371b26

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS03BE6B77\ThemeFile
    Filesize

    80KB

    MD5

    c3e6bab4f92ee40b9453821136878993

    SHA1

    94493a6b3dfb3135e5775b7d3be227659856fbc4

    SHA256

    de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

    SHA512

    a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsn7E54.tmp\BgWorker.dll
    Filesize

    12KB

    MD5

    36c81676ada53ceb99e06693108d8cce

    SHA1

    d31fa4aebd584238b3edc4768dd5414494610889

    SHA256

    a9e4f7ec65670d2ce375ffaf09b6d07f4cd531132ca002452287a4d540154a38

    SHA512

    1300de7b3e1ac9e706e0aad0b70e3e2a21db8c860e05b314a52e63dd66b5dffdf6be1e38ab6ede13bfd3a64631cc909486bf4b1403e7d821e3b566edc514c63c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsn7E54.tmp\System.dll
    Filesize

    11KB

    MD5

    959ea64598b9a3e494c00e8fa793be7e

    SHA1

    40f284a3b92c2f04b1038def79579d4b3d066ee0

    SHA256

    03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b

    SHA512

    5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsn7E54.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    f7b92b78f1a00a872c8a38f40afa7d65

    SHA1

    872522498f69ad49270190c74cf3af28862057f2

    SHA256

    2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e

    SHA512

    3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsn7E54.tmp\nsDui.dll
    Filesize

    3.0MB

    MD5

    b056b383eb1f5293053c144f07159805

    SHA1

    4a49f417dd9a9c8c21799fa3e9bfcab21cdbedaf

    SHA256

    19a7c2d8ba4397734162bea6f35ceec11752fea940b27bcabb3d22c5d50d6f78

    SHA512

    c9a8736636a47aa1fa9af690ef9e9c6990647c109ba18d56c958983099ef699e162759db77ffb7813a32af7a4a97406d59ae8d447314863da2ed00a0db016432

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsn7E54.tmp\nsis7z.dll
    Filesize

    434KB

    MD5

    95f6f6ab9509bc366ab9215defe4251a

    SHA1

    e3f4a6effd6ca5838cfe91a01967cb72edcc7b0b

    SHA256

    a896a9ece055d334d431cd0f856113ab925d9ee86d2dee383c0bfbbef11a5b50

    SHA512

    a853f70d2ea7f384df99be067724bf3ca73c63f3c3573c112f5528fc86a96bd34509d934b038e2a81833f3abb3eedbc5894921291139100e01df6e35696c0ecc

    Download Submit

  • memory/1148-144-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1148-146-0x00007FFFDEF90000-0x00007FFFDF03E000-memory.dmp

    Filesize

    696KB

    Download

  • memory/1148-135-0x000000001C650000-0x000000001C65E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1148-131-0x000000001C700000-0x000000001CC28000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/1148-123-0x00000000024D0000-0x0000000002538000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1148-134-0x000000001C680000-0x000000001C6B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1148-121-0x00007FFFDEF90000-0x00007FFFDF03E000-memory.dmp

    Filesize

    696KB

    Download

  • memory/1148-120-0x00000000002B0000-0x000000000034E000-memory.dmp

    Filesize

    632KB

    Download

  • memory/1148-119-0x00007FFFDEF90000-0x00007FFFDF03E000-memory.dmp

    Filesize

    696KB

    Download