Analysis
-
max time kernel
595s -
max time network
436s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-11-2024 16:32
Behavioral task
behavioral1
Sample
!!!Readme_first!!!!.txt
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Download More.url
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Jasi2169_Patch/WindowBlinds_11.02_Jasi2169_Patch.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Join Telegram QR.png
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Join Telegram for more.url
Resource
win11-20241007-en
General
-
Target
WindowBlinds11_setup.exe
-
Size
95.4MB
-
MD5
72ecc6b491dbc5a46ab9f215c556691c
-
SHA1
652c3d358185405793a91dbb8d38cfaab052383d
-
SHA256
04128112e38f9f5f4f4441396407cc6128226f7638aef512419a9aa24b6be1ce
-
SHA512
6e355a4c1947c68aa75af13ca5d1c59dc72e17df22cf423400d53b2875385d16771121a2f80b70c250eb50ad65a5cba5c13b67028ae6c269f87e319d54bba2c5
-
SSDEEP
1572864:SAwUb6en83FlhNoMEvpbfJimmatUGKWvhJiorxsJivsE2I+oYk0qQIr5ZuW+a+:jGiMrhNohTcBoUfWJcSOcUE71YZqbLwr
Malware Config
Signatures
-
resource yara_rule behavioral6/files/0x001900000002aae9-5.dat upx behavioral6/memory/3764-14-0x0000000000020000-0x0000000000408000-memory.dmp upx behavioral6/memory/3764-83-0x0000000000020000-0x0000000000408000-memory.dmp upx behavioral6/memory/3764-88-0x0000000000020000-0x0000000000408000-memory.dmp upx -
Executes dropped EXE 2 IoCs
pid Process 3764 irsetup.exe 3592 GetMachineSID.exe -
Loads dropped DLL 4 IoCs
pid Process 3764 irsetup.exe 3764 irsetup.exe 3764 irsetup.exe 3764 irsetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowBlinds11_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GetMachineSID.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3764 irsetup.exe 3764 irsetup.exe 3764 irsetup.exe 3592 GetMachineSID.exe 3764 irsetup.exe 3764 irsetup.exe 3764 irsetup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3764 3868 WindowBlinds11_setup.exe 80 PID 3868 wrote to memory of 3764 3868 WindowBlinds11_setup.exe 80 PID 3868 wrote to memory of 3764 3868 WindowBlinds11_setup.exe 80 PID 3764 wrote to memory of 1384 3764 irsetup.exe 83 PID 3764 wrote to memory of 1384 3764 irsetup.exe 83 PID 3764 wrote to memory of 1384 3764 irsetup.exe 83 PID 3764 wrote to memory of 3592 3764 irsetup.exe 85 PID 3764 wrote to memory of 3592 3764 irsetup.exe 85 PID 3764 wrote to memory of 3592 3764 irsetup.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe"C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1981986 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-2584844841-1405471295-1760131749-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /y /reg:323⤵
- System Location Discovery: System Language Discovery
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3592
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
393KB
MD56eec47ab86d212fe3ed0f56985c8e817
SHA106da90bcc06c73ce2c7e112818af65f66fcae6c3
SHA256d0b2fa60e707982899ecd8c4dc462721c82491245b26721a7c0e840c5f557aed
SHA51236d6ef8a3fecb2c423079cadbfcbe2b044095f641c9a6ce0f9d0e96c6400f00a089aa26cc9d361bfdbcfdc3a8487d18d64956b36f39320648d1ddb565221a9cb
-
Filesize
58KB
MD555bbf335f75f2a2fe0a5daf603964d41
SHA1f1b9686e8a9f10682722fc5e08c02c016b597804
SHA256723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
SHA512af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6
-
Filesize
41B
MD52d1a578c0fddd7b64268303ab0937500
SHA15479fbe1eddd7793d38a943f6c485e20f20544c5
SHA25699c94d77c0a415b768e70ed8dc6f0ced91b2a29b5d184e54c5ff9ec9a393f039
SHA5124d0fe15b9ebde46da7d77f077140a2863c711482ab1932d1c126181e1eb4f6279d6d49825924865c992ff75d2f26ce5ac0abdcdff07158419119f4190c8cfa95
-
Filesize
2KB
MD53220a6aefb4fc719cc8849f060859169
SHA185f624debcefd45fdfdf559ac2510a7d1501b412
SHA256988cf422cbf400d41c48fbe491b425a827a1b70691f483679c1df02fb9352765
SHA5125c45ea8f64b3cdfb262c642bd36b08c822427150d28977af33c9021a6316b6efed83f3172c16343fd703d351af3966b06926e5b33630d51b723709712689881d
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD568ac216f38a5f7c823712c216ca4b060
SHA1f6ad96e91103c40eb33fd3f1324d99093e5d014e
SHA256748d48d246526e2a79edcde87255ffa5387e3bcc94f6ca5e59589e07e683cd80
SHA5129b7dce4ed6e2caee1cdb33e490e7062344d95d27ba48e96f66094a3413da27fb32680dd2e9a5b2091489780929c27fe36914210793fbef81dfb5b4fb1a9b469b
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4