Overview
overview
5Static
static
3Download More.url
windows7-x64
1Download More.url
windows10-2004-x64
1Jasi2169_P...ch.exe
windows7-x64
3Jasi2169_P...ch.exe
windows10-2004-x64
3Join Teleg...re.url
windows7-x64
1Join Teleg...re.url
windows10-2004-x64
1WindowBlin...up.exe
windows7-x64
5WindowBlin...up.exe
windows10-2004-x64
5Analysis
-
max time kernel
23s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 16:36
Behavioral task
behavioral1
Sample
Download More.url
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Download More.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Jasi2169_Patch/WindowBlinds_11.02_Jasi2169_Patch.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
Jasi2169_Patch/WindowBlinds_11.02_Jasi2169_Patch.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Join Telegram for more.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Join Telegram for more.url
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
WindowBlinds11_setup.exe
Resource
win7-20240903-en
General
-
Target
WindowBlinds11_setup.exe
-
Size
95.4MB
-
MD5
72ecc6b491dbc5a46ab9f215c556691c
-
SHA1
652c3d358185405793a91dbb8d38cfaab052383d
-
SHA256
04128112e38f9f5f4f4441396407cc6128226f7638aef512419a9aa24b6be1ce
-
SHA512
6e355a4c1947c68aa75af13ca5d1c59dc72e17df22cf423400d53b2875385d16771121a2f80b70c250eb50ad65a5cba5c13b67028ae6c269f87e319d54bba2c5
-
SSDEEP
1572864:SAwUb6en83FlhNoMEvpbfJimmatUGKWvhJiorxsJivsE2I+oYk0qQIr5ZuW+a+:jGiMrhNohTcBoUfWJcSOcUE71YZqbLwr
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation WindowBlinds11_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation irsetup.exe -
resource yara_rule behavioral8/files/0x000a000000023ba3-5.dat upx behavioral8/memory/2376-12-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral8/memory/2376-65-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral8/memory/2376-79-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx behavioral8/memory/2376-84-0x0000000000BE0000-0x0000000000FC8000-memory.dmp upx -
Executes dropped EXE 2 IoCs
pid Process 2376 irsetup.exe 4860 GetMachineSID.exe -
Loads dropped DLL 4 IoCs
pid Process 2376 irsetup.exe 2376 irsetup.exe 2376 irsetup.exe 2376 irsetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GetMachineSID.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowBlinds11_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2376 irsetup.exe 2376 irsetup.exe 2376 irsetup.exe 4860 GetMachineSID.exe 2376 irsetup.exe 2376 irsetup.exe 2376 irsetup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 840 wrote to memory of 2376 840 WindowBlinds11_setup.exe 86 PID 840 wrote to memory of 2376 840 WindowBlinds11_setup.exe 86 PID 840 wrote to memory of 2376 840 WindowBlinds11_setup.exe 86 PID 2376 wrote to memory of 764 2376 irsetup.exe 88 PID 2376 wrote to memory of 764 2376 irsetup.exe 88 PID 2376 wrote to memory of 764 2376 irsetup.exe 88 PID 2376 wrote to memory of 4860 2376 irsetup.exe 90 PID 2376 wrote to memory of 4860 2376 irsetup.exe 90 PID 2376 wrote to memory of 4860 2376 irsetup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe"C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1981986 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\WindowBlinds11_setup.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-940901362-3608833189-1915618603-1000"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" export HKLM\Software\Stardock C:\Users\Admin\AppData\Local\Temp\registry_export.txt /y /reg:323⤵
- System Location Discovery: System Language Discovery
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.exe" C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\GetMachineSID.tmp3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4860
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
393KB
MD56eec47ab86d212fe3ed0f56985c8e817
SHA106da90bcc06c73ce2c7e112818af65f66fcae6c3
SHA256d0b2fa60e707982899ecd8c4dc462721c82491245b26721a7c0e840c5f557aed
SHA51236d6ef8a3fecb2c423079cadbfcbe2b044095f641c9a6ce0f9d0e96c6400f00a089aa26cc9d361bfdbcfdc3a8487d18d64956b36f39320648d1ddb565221a9cb
-
Filesize
58KB
MD555bbf335f75f2a2fe0a5daf603964d41
SHA1f1b9686e8a9f10682722fc5e08c02c016b597804
SHA256723adae0e69127a6bfbc65c5ef552a351264205ea5e2bc3b80e505feaa5d0e43
SHA512af49055234cb4a0ddbc68212db094c7a7a1058ccf6a1a5830238fe3ff96fa35390d242322436839d6d7e419bd9e4ad8962e213222470625cffb46423dec44db6
-
Filesize
40B
MD56d6cb67cd48dcf308659c0468bc3e69f
SHA1824bfa48cf3ae8dca339262b99c90797e6eb34e4
SHA256e284975f7f465c7cbfd0576d807f539ec1f5621b86fd512297f10a38b7df435d
SHA512a53fdc9a7f72f9bbaeff3bbb88ec2d6bc3d2a6e2b379fc973b0efdfcfd914ba1fd1d04428a4c85acd5e13c961701941a9da4d3833172da8fda47bd2777d48c42
-
Filesize
2KB
MD53220a6aefb4fc719cc8849f060859169
SHA185f624debcefd45fdfdf559ac2510a7d1501b412
SHA256988cf422cbf400d41c48fbe491b425a827a1b70691f483679c1df02fb9352765
SHA5125c45ea8f64b3cdfb262c642bd36b08c822427150d28977af33c9021a6316b6efed83f3172c16343fd703d351af3966b06926e5b33630d51b723709712689881d
-
Filesize
97KB
MD5da1d0cd400e0b6ad6415fd4d90f69666
SHA1de9083d2902906cacf57259cf581b1466400b799
SHA2567a79b049bdc3b6e4d101691888360f4f993098f3e3a8beefff4ac367430b1575
SHA512f12f64670f158c2e846e78b7b5d191158268b45ecf3c288f02bbee15ae10c4a62e67fb3481da304ba99da2c68ac44d713a44a458ef359db329b6fef3d323382a
-
Filesize
1.3MB
MD568ac216f38a5f7c823712c216ca4b060
SHA1f6ad96e91103c40eb33fd3f1324d99093e5d014e
SHA256748d48d246526e2a79edcde87255ffa5387e3bcc94f6ca5e59589e07e683cd80
SHA5129b7dce4ed6e2caee1cdb33e490e7062344d95d27ba48e96f66094a3413da27fb32680dd2e9a5b2091489780929c27fe36914210793fbef81dfb5b4fb1a9b469b
-
Filesize
326KB
MD580d93d38badecdd2b134fe4699721223
SHA1e829e58091bae93bc64e0c6f9f0bac999cfda23d
SHA256c572a6103af1526f97e708a229a532fd02100a52b949f721052107f1f55e0c59
SHA5129f28073cc186b55ef64661c2e4f6fe1c112785a262b9d8e9a431703fdb1000f1d8cc0b2a3c153c822cfd48782ae945742ccb07beae4d6388d5d0b4df03103bd4