Analysis

  • max time kernel
    135s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2024 16:28

General

  • Target

    BlueStacks10Installer_10.41.510.1006_native_a246a283610c5806c9bd24c46e41639f_MDs1LDM7MTUsMTsxNSw0OzE1LA==.exe

  • Size

    912KB

  • MD5

    90e3edf39bfde7d3b841443ad22707a5

  • SHA1

    001a05a2e6398db229d0e9911305fb09f05f4306

  • SHA256

    59bdef6c93910de0e4036c73c537d9d13e12a9754fd40ff928b5b4b328843ef2

  • SHA512

    4eb4acfb707aecc8b496c37b8de462d0c2823e2f4e976bb8c4c45da946e6f1046690dd55ddbb1819ea71e606cdd85bed316011b3d18d136f73c5e8eab1260c28

  • SSDEEP

    24576:nivtCXWeGKe8f7bi7JoWdlTmCyhlIvMewd4C:itCXWPSnit/lTmCy4vMewyC

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.41.510.1006_native_a246a283610c5806c9bd24c46e41639f_MDs1LDM7MTUsMTsxNSw0OzE1LA==.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacks10Installer_10.41.510.1006_native_a246a283610c5806c9bd24c46e41639f_MDs1LDM7MTUsMTsxNSw0OzE1LA==.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4392
    • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS821F0887\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3940
      • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS821F0887\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3344
      • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS821F0887\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\backicon.png

    Filesize

    15KB

    MD5

    7ff5dc8270b5fa7ef6c4a1420bd67a7f

    SHA1

    b224300372feaa97d882ca2552b227c0f2ef4e3e

    SHA256

    fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

    SHA512

    f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\change_hover.png

    Filesize

    310B

    MD5

    57092634754fc26e5515e3ed5ca7d461

    SHA1

    3ae4d01db9d6bba535f5292298502193dfc02710

    SHA256

    8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1

    SHA512

    553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\close_red.png

    Filesize

    15KB

    MD5

    93216b2f9d66d423b3e1311c0573332d

    SHA1

    5efaebec5f20f91f164f80d1e36f98c9ddaff805

    SHA256

    d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

    SHA512

    922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\custom.png

    Filesize

    17KB

    MD5

    03b17f0b1c067826b0fcc6746cced2cb

    SHA1

    e07e4434e10df4d6c81b55fceb6eca2281362477

    SHA256

    fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

    SHA512

    67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\installer_bg.jpg

    Filesize

    78KB

    MD5

    3478e24ba1dd52c80a0ff0d43828b6b5

    SHA1

    b5b13bbf3fb645efb81d3562296599e76a2abac0

    SHA256

    4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

    SHA512

    5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\installer_logo.png

    Filesize

    14KB

    MD5

    e33432b5d6dafb8b58f161cf38b8f177

    SHA1

    d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

    SHA256

    9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

    SHA512

    520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\installer_minimize.png

    Filesize

    113B

    MD5

    38b539a1e4229738e5c196eedb4eb225

    SHA1

    f027b08dce77c47aaed75a28a2fce218ff8c936c

    SHA256

    a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

    SHA512

    2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\loader.png

    Filesize

    279B

    MD5

    03903fd42ed2ee3cb014f0f3b410bcb4

    SHA1

    762a95240607fe8a304867a46bc2d677f494f5c2

    SHA256

    076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

    SHA512

    8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Assets\setpath.png

    Filesize

    15KB

    MD5

    b2e7f40179744c74fded932e829cb12a

    SHA1

    a0059ab8158a497d2cf583a292b13f87326ec3f0

    SHA256

    5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

    SHA512

    b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\BlueStacksInstaller.exe

    Filesize

    627KB

    MD5

    71288608c071c86508ed89ace87e2603

    SHA1

    315ed87ffa8ea140493659241db70d6eab8679a5

    SHA256

    2fde30ea7dfce2e7c0e79b36f903e0787dc39037698f1cd7cbd1eee3ae2aeed9

    SHA512

    7fcd84ceb273e043997b7de30a07e3079fda51dc4bb655c5ac0ba24e9c7d79af8ed5f5dee5ec41454fe16d6ed3d5668c95f07878ca08a2ec8097403f31a577e2

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\BlueStacksInstaller.exe.config

    Filesize

    324B

    MD5

    1b456d88546e29f4f007cd0bf1025703

    SHA1

    e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

    SHA256

    d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

    SHA512

    c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\HD-CheckCpu.exe

    Filesize

    200KB

    MD5

    81234fd9895897b8d1f5e6772a1b38d0

    SHA1

    80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

    SHA256

    2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

    SHA512

    4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\JSON.dll

    Filesize

    411KB

    MD5

    f5fd966e29f5c359f78cb61a571d1be4

    SHA1

    a55e7ed593b4bc7a77586da0f1223cfd9d51a233

    SHA256

    d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

    SHA512

    d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\Locales\i18n.en-US.txt

    Filesize

    20KB

    MD5

    a1e3293265a273080e68501ffdb9c2fc

    SHA1

    add264c4a560ce5803ca7b19263f8cd3ed6f68f0

    SHA256

    1cb847f640d0b2b363ce3c44872c4227656e8d2f1b4a5217603a62d802f0581f

    SHA512

    cb61083dc4d7d86f855a4cc3fe7c4938232a55188ad08b028a12445675fbff6188bb40638bd1ce4e6077f5bfc94449c145118c8f9b8929d4e9c47ed74cf7bece

  • C:\Users\Admin\AppData\Local\Temp\7zS821F0887\ThemeFile

    Filesize

    80KB

    MD5

    c3e6bab4f92ee40b9453821136878993

    SHA1

    94493a6b3dfb3135e5775b7d3be227659856fbc4

    SHA256

    de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

    SHA512

    a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

  • memory/3940-125-0x00007FFDA1D93000-0x00007FFDA1D95000-memory.dmp

    Filesize

    8KB

  • memory/3940-141-0x000000001DD70000-0x000000001DD7E000-memory.dmp

    Filesize

    56KB

  • memory/3940-128-0x000000001D450000-0x000000001D4B8000-memory.dmp

    Filesize

    416KB

  • memory/3940-129-0x00007FFDA1D90000-0x00007FFDA2851000-memory.dmp

    Filesize

    10.8MB

  • memory/3940-126-0x0000000000F00000-0x0000000000FA0000-memory.dmp

    Filesize

    640KB

  • memory/3940-139-0x00007FFDA1D90000-0x00007FFDA2851000-memory.dmp

    Filesize

    10.8MB

  • memory/3940-140-0x000000001DDA0000-0x000000001DDD8000-memory.dmp

    Filesize

    224KB

  • memory/3940-137-0x000000001E7D0000-0x000000001ECF8000-memory.dmp

    Filesize

    5.2MB

  • memory/3940-150-0x00000000224D0000-0x00000000224D8000-memory.dmp

    Filesize

    32KB

  • memory/3940-135-0x00007FFDA1D90000-0x00007FFDA2851000-memory.dmp

    Filesize

    10.8MB

  • memory/3940-152-0x00007FFDA1D93000-0x00007FFDA1D95000-memory.dmp

    Filesize

    8KB

  • memory/3940-153-0x00007FFDA1D90000-0x00007FFDA2851000-memory.dmp

    Filesize

    10.8MB

  • memory/3940-154-0x00007FFDA1D90000-0x00007FFDA2851000-memory.dmp

    Filesize

    10.8MB