35ae80f3781c2af00531dbdabe71af3003662fc11faad99fd31c30ac3b34627c

Analysis

max time kernel
149s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20/06/2024, 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Blindness/blindness.exe
Size

16.3MB
MD5

bfcedc7b86fff9e36e0889a8b321a3b1
SHA1

b0a6af2ce0580f1d629886ec26b1ffa4eab43d8f
SHA256

df2108aaa31cab9f7b965f7c1652a446693cb529c96ea852869c85e037c438b2
SHA512

0478733da658c4269abe0075c467b6f176cbefd7c4c188ef66c6d959dc5443ed94fa182e705b67682f33254c43f3e745e6b2cec2f877fade1f3f1ef3e4f6f5e6
SSDEEP

393216:y3Z8A06vEQ3ITvzx46SxiILGREuV3WjRI85:y3ZIzx46YNL6W9Ie

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 43 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\RPCRT4.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\version.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\wininet.dll	blindness.exe
File opened for modification	C:\Windows\system32\explorerframe.dll	blindness.exe
File opened for modification	C:\Windows\System32\MSCTF.dll	blindness.exe
File opened for modification	C:\Windows\System32\user32.dll	blindness.exe
File opened for modification	C:\Windows\System32\shcore.dll	blindness.exe
File opened for modification	C:\Windows\System32\imm32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\wsock32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\hhctrl.ocx	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\uxtheme.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\ntdll.dll	blindness.exe
File opened for modification	C:\Windows\System32\msvcp_win.dll	blindness.exe
File opened for modification	C:\Windows\System32\GDI32.dll	blindness.exe
File opened for modification	C:\Windows\System32\shell32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\opengl32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\GLU32.dll	blindness.exe
File opened for modification	C:\Windows\System32\gdi32full.dll	blindness.exe
File opened for modification	C:\Windows\System32\advapi32.dll	blindness.exe
File opened for modification	C:\Windows\System32\cfgmgr32.dll	blindness.exe
File opened for modification	C:\Windows\System32\powrprof.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\winmm.dll	blindness.exe
File opened for modification	C:\Windows\System32\KERNEL32.DLL	blindness.exe
File opened for modification	C:\Windows\System32\win32u.dll	blindness.exe
File opened for modification	C:\Windows\System32\windows.storage.dll	blindness.exe
File opened for modification	C:\Windows\System32\ole32.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\WINMMBASE.dll	blindness.exe
File opened for modification	C:\Windows\System32\combase.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\msimg32.dll	blindness.exe
File opened for modification	C:\Windows\System32\clbcatq.dll	blindness.exe
File opened for modification	C:\Windows\System32\bcryptPrimitives.dll	blindness.exe
File opened for modification	C:\Windows\System32\shlwapi.dll	blindness.exe
File opened for modification	C:\Windows\System32\comdlg32.dll	blindness.exe
File opened for modification	C:\Windows\System32\psapi.dll	blindness.exe
File opened for modification	C:\Windows\System32\kernel.appcore.dll	blindness.exe
File opened for modification	C:\Windows\System32\profapi.dll	blindness.exe
File opened for modification	C:\Windows\System32\ws2_32.dll	blindness.exe
File opened for modification	C:\Windows\System32\KERNELBASE.dll	blindness.exe
File opened for modification	C:\Windows\System32\oleaut32.dll	blindness.exe
File opened for modification	C:\Windows\System32\ucrtbase.dll	blindness.exe
File opened for modification	C:\Windows\System32\msvcrt.dll	blindness.exe
File opened for modification	C:\Windows\System32\sechost.dll	blindness.exe
File opened for modification	C:\Windows\SYSTEM32\PROPSYS.dll	blindness.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.15063.0_none_108e4f62dfe5d999\comctl32.dll	blindness.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3572	blindness.exe
3572	blindness.exe
3572	blindness.exe
3572	blindness.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	blindness.exe
Token: SeTcbPrivilege	3572	blindness.exe
Token: SeTcbPrivilege	3572	blindness.exe
Token: SeLoadDriverPrivilege	3572	blindness.exe
Token: SeCreateGlobalPrivilege	3572	blindness.exe
Token: SeLockMemoryPrivilege	3572	blindness.exe
Token: 33	3572	blindness.exe
Token: SeSecurityPrivilege	3572	blindness.exe
Token: SeTakeOwnershipPrivilege	3572	blindness.exe
Token: SeManageVolumePrivilege	3572	blindness.exe
Token: SeBackupPrivilege	3572	blindness.exe
Token: SeCreatePagefilePrivilege	3572	blindness.exe
Token: SeShutdownPrivilege	3572	blindness.exe
Token: SeRestorePrivilege	3572	blindness.exe
Token: 33	3572	blindness.exe
Token: SeIncBasePriorityPrivilege	3572	blindness.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3572	blindness.exe

C:\Users\Admin\AppData\Local\Temp\Blindness\blindness.exe
"C:\Users\Admin\AppData\Local\Temp\Blindness\blindness.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Blindness\ExceptionAutoSave_noname.ct

Filesize
142B

MD5
3884fb959fad700da29722b14c1dd645

SHA1
6612989411d0f47a2ca3ffdf6d1fb4c50b223536

SHA256
4b8de0aac70e1b75709d6b3f0be1ae3d77408196506fa8300215f484ebc718d8

SHA512
0b2be4fd787402bbc4f71480a6248a4f5cd909a8c76aa7b63c48f621a736fbf40c07adf4c4e7ee6398225fa3906c6aecd6b70fc4cac026b3092ce5bc030a0be2

Download Submit
memory/3572-1-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/3572-0-0x0000000006D40000-0x0000000006D41000-memory.dmp

Filesize
4KB

Download
memory/3572-3-0x0000000006D50000-0x0000000006D51000-memory.dmp

Filesize
4KB

Download
memory/3572-5-0x0000000006D60000-0x0000000006D61000-memory.dmp

Filesize
4KB

Download
memory/3572-7-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/3572-9-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/3572-13-0x0000000006D90000-0x0000000006D91000-memory.dmp

Filesize
4KB

Download
memory/3572-15-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

Filesize
4KB

Download
memory/3572-17-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

Filesize
4KB

Download
memory/3572-19-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

Filesize
4KB

Download