cb11f3b1500e002c78c3f74397adf898e96d001d853faa552106f1ddf02b90fc

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BLTools 2.9.1 Pro.rar
Size

11.3MB
MD5

61f16f75859721ad978380be1897f028
SHA1

b94c13a9950b674f0028bd75caa63839f3541d33
SHA256

cb11f3b1500e002c78c3f74397adf898e96d001d853faa552106f1ddf02b90fc
SHA512

ace39332ffbf8348f4d826351654a86c711917acd8c00b5da4f689051e12053019a2a86d0b4f2d09fc4947ee6cea1f947835cfd43ea8f5ccff62cbeb7a107673
SSDEEP

196608:k3LJkrz6F0SWpYAbCt8E9Xbx8CBA2lWJa6pTgv5e36Yt//:iJCz6PWhbk9Xbx8CBAIWXpV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2708	2244	cmd.exe	31
PID 2244 wrote to memory of 2708	2244	cmd.exe	31
PID 2244 wrote to memory of 2708	2244	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\BLTools 2.9.1 Pro.rar
  2⤵
  - Modifies registry class
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...