Analysis

  • max time kernel
    147s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2024, 03:29

General

  • Target

    BlueStacksInstaller_5.21.600.1019_native_a2dd660d2ed14f232e1cf3aea7ede127_MDs1.exe

  • Size

    913KB

  • MD5

    86b016ee6a71a5219f56779885f691ef

  • SHA1

    1a40a93403e1004f7f8033c5afee8196db16700a

  • SHA256

    a56fd8aa5ffdaddaf58e4fbe8cbb2359fd11f2a93f34d9d0df610baf96972207

  • SHA512

    9f9860782ad93a3a43a9d4509635ac5a08317d3ee60ae314ebdaf4b61855c0a697ca0e5561b5452040763bec719394baaaa1ac4c23c00842be4806ab4dde42a7

  • SSDEEP

    12288:tivtCXQd0gjKX7zuqGKY5Ha3z1cNoaMq+zfxUEwOwGPaGb4hmsLBeJs0RXfGPtRF:tivtCXWeGKY81Oq8wX5RXfGPTSKdvaU

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.21.600.1019_native_a2dd660d2ed14f232e1cf3aea7ede127_MDs1.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueStacksInstaller_5.21.600.1019_native_a2dd660d2ed14f232e1cf3aea7ede127_MDs1.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\BlueStacksInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\BlueStacksInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\HD-CheckCpu.exe" --cmd checkHypervEnabled
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\HD-CheckCpu.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\HD-CheckCpu.exe" --cmd checkSSE4
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1712

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\backicon.png

          Filesize

          15KB

          MD5

          7ff5dc8270b5fa7ef6c4a1420bd67a7f

          SHA1

          b224300372feaa97d882ca2552b227c0f2ef4e3e

          SHA256

          fa64884054171515e97b78aaa1aad1ec5baa9d1daf9c682e0b3fb4a41a9cb1c1

          SHA512

          f0d5a842a01b99f189f3d46ab59d2c388a974951b042b25bbce54a15f5a3f386984d19cfca22ba1440eebd79260066a37dfeff6cb0d1332fca136add14488eef

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\change_hover.png

          Filesize

          310B

          MD5

          57092634754fc26e5515e3ed5ca7d461

          SHA1

          3ae4d01db9d6bba535f5292298502193dfc02710

          SHA256

          8e5847487da148ebb3ea029cc92165afd215cdc08f7122271e13eb37f94e6dc1

          SHA512

          553baf9967847292c8e9249dc3b1d55069f51c79f4d1d3832a0036e79691f433a3ce8296a68c774b5797caf7000037637ce61b8365885d2a4eed3ff0730e5e2a

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\close_red.png

          Filesize

          15KB

          MD5

          93216b2f9d66d423b3e1311c0573332d

          SHA1

          5efaebec5f20f91f164f80d1e36f98c9ddaff805

          SHA256

          d0b6d143642d356b40c47459a996131a344cade6bb86158f1b74693426b09bfb

          SHA512

          922a7292de627c5e637818556d25d9842a88e89f2b198885835925679500dfd44a1e25ce79e521e63c4f84a6b0bd6bf98e46143ad8cee80ecdbaf3d3bc0f3a32

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\custom.png

          Filesize

          17KB

          MD5

          03b17f0b1c067826b0fcc6746cced2cb

          SHA1

          e07e4434e10df4d6c81b55fceb6eca2281362477

          SHA256

          fbece8bb5f4dfa55dcfbf41151b10608af807b9477e99acf0940954a11e68f7b

          SHA512

          67c78ec01e20e9c8d9cdbba665bb2fd2bb150356f30b88d3d400bbdb0ae92010f5d7bcb683dcf6f895722a9151d8e669d8bef913eb6e728ba56bb02f264573b2

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\installer_bg.jpg

          Filesize

          78KB

          MD5

          3478e24ba1dd52c80a0ff0d43828b6b5

          SHA1

          b5b13bbf3fb645efb81d3562296599e76a2abac0

          SHA256

          4c7471c986e16de0cd451be27d4b3171e595fe2916b4b3bf7ca52df6ec368904

          SHA512

          5c8c9cc76d6dbc7ce482d0d1b6c2f3d48a7a510cd9ed01c191328763e1bccb56daeb3d18c33a9b10ac7c9780127007aa13799fa82d838de27fbe0a02ad98119d

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\installer_logo.png

          Filesize

          14KB

          MD5

          e33432b5d6dafb8b58f161cf38b8f177

          SHA1

          d7f520887ce1bfa0a1abd49c5a7b215c24cbbf6a

          SHA256

          9f3104493216c1fa114ff935d23e3e41c7c3511792a30b10a40b507936c0d183

          SHA512

          520dc99f3176117ebc28da5ef5439b132486ef67d02fa17f28b7eab0c59db0fa99566e44c0ca7bb75c9e7bd5244e4a23d87611a55c841c6f9c9776e457fb1cbf

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\installer_minimize.png

          Filesize

          113B

          MD5

          38b539a1e4229738e5c196eedb4eb225

          SHA1

          f027b08dce77c47aaed75a28a2fce218ff8c936c

          SHA256

          a064f417e3c2b8f3121a14bbded268b2cdf635706880b7006f931de31476bbc2

          SHA512

          2ce433689a94fae454ef65e0e9ec33657b89718bbb5a038bf32950f6d68722803922f3a427278bad432395a1716523e589463fcce4279dc2a895fd77434821cc

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\loader.png

          Filesize

          279B

          MD5

          03903fd42ed2ee3cb014f0f3b410bcb4

          SHA1

          762a95240607fe8a304867a46bc2d677f494f5c2

          SHA256

          076263cc65f9824f4f82eb6beaa594d1df90218a2ee21664cf209181557e04b1

          SHA512

          8b0e717268590e5287c07598a06d89220c5e9a33cd1c29c55f8720321f4b3efc869d20c61fcc892e13188d77f0fdc4c73a2ee6dece174bf876fcc3a6c5683857

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Assets\setpath.png

          Filesize

          15KB

          MD5

          b2e7f40179744c74fded932e829cb12a

          SHA1

          a0059ab8158a497d2cf583a292b13f87326ec3f0

          SHA256

          5bbb2f41f9f3a805986c3c88a639bcc22d90067d4b8de9f1e21e3cf9e5c1766b

          SHA512

          b95b7ebdb4a74639276eaa5c055fd8d9431e2f58a5f7c57303f7cf22e8b599f6f2a7852074cf71b19b49eb31cc9bf2509aedf41d608981d116e49a00030c797c

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\BlueStacksInstaller.exe

          Filesize

          629KB

          MD5

          0d021ad9fc86a22215cd014b088f307e

          SHA1

          531e18244b9a43798562c1297c09ccc0239adb61

          SHA256

          c14eb1c61d737e195ce06cb84ba2b05925dcf36ac35c1078f260e423b1ad3485

          SHA512

          e5d977d5a3f5a5888e054521168a9ac22712892d5aea225a6f545e9be885deef1983fbcd963927367b2d7439c18b2e6c71a6b143a924a41f5acabc76e0a6e993

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\BlueStacksInstaller.exe.config

          Filesize

          324B

          MD5

          1b456d88546e29f4f007cd0bf1025703

          SHA1

          e5c444fcfe5baf2ef71c1813afc3f2c1100cab86

          SHA256

          d6d316584b63bb0d670a42f88b8f84e0de0db4275f1a342084dc383ebeb278eb

          SHA512

          c545e416c841b8786e4589fc9ca2b732b16cdd759813ec03f558332f2436f165ec1ad2fbc65012b5709fa19ff1e8396639c17bfad150cabeb51328a39ea556e6

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\HD-CheckCpu.exe

          Filesize

          200KB

          MD5

          81234fd9895897b8d1f5e6772a1b38d0

          SHA1

          80b2fec4a85ed90c4db2f09b63bd8f37038db0d3

          SHA256

          2e14887f3432b4a313442247fc669f891dbdad7ef1a2d371466a2afa88074a4c

          SHA512

          4c924d6524dc2c7d834bfc1a0d98b21753a7bf1e94b1c2c6650f755e6f265512d3a963bc7bc745351f79f547add57c37e29ba9270707edbf62b60df3a541bc16

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\JSON.dll

          Filesize

          411KB

          MD5

          f5fd966e29f5c359f78cb61a571d1be4

          SHA1

          a55e7ed593b4bc7a77586da0f1223cfd9d51a233

          SHA256

          d2c8d26f95f55431e632c8581154db7c19547b656380e051194a9d2583dd2156

          SHA512

          d99e6fe250bb106257f86135938635f6e7ad689b2c11a96bb274f4c4c5e9a85cfacba40122dbc953f77b5d33d886c6af30bff821f10945e15b21a24b66f6c8be

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\Locales\i18n.en-US.txt

          Filesize

          20KB

          MD5

          a1e3293265a273080e68501ffdb9c2fc

          SHA1

          add264c4a560ce5803ca7b19263f8cd3ed6f68f0

          SHA256

          1cb847f640d0b2b363ce3c44872c4227656e8d2f1b4a5217603a62d802f0581f

          SHA512

          cb61083dc4d7d86f855a4cc3fe7c4938232a55188ad08b028a12445675fbff6188bb40638bd1ce4e6077f5bfc94449c145118c8f9b8929d4e9c47ed74cf7bece

        • C:\Users\Admin\AppData\Local\Temp\7zS0EB85448\ThemeFile

          Filesize

          80KB

          MD5

          c3e6bab4f92ee40b9453821136878993

          SHA1

          94493a6b3dfb3135e5775b7d3be227659856fbc4

          SHA256

          de1a2e6b560e036da5ea6b042e29e81a5bfcf67dde89670c332fc5199e811ba6

          SHA512

          a64b6b06b3a0f3591892b60e59699682700f4018b898efe55d6bd5fb417965a55027671c58092d1eb7e21c2dbac42bc68dfb8c70468d98bed45a8cff0e945895

        • memory/1972-128-0x000000001AFA0000-0x000000001B008000-memory.dmp

          Filesize

          416KB

        • memory/1972-163-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1972-138-0x000000001D640000-0x000000001DB68000-memory.dmp

          Filesize

          5.2MB

        • memory/1972-137-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1972-135-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1972-129-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1972-150-0x00000000218E0000-0x00000000218E8000-memory.dmp

          Filesize

          32KB

        • memory/1972-140-0x000000001CCA0000-0x000000001CCD8000-memory.dmp

          Filesize

          224KB

        • memory/1972-141-0x000000001C9B0000-0x000000001C9BE000-memory.dmp

          Filesize

          56KB

        • memory/1972-125-0x00007FF8BFF33000-0x00007FF8BFF35000-memory.dmp

          Filesize

          8KB

        • memory/1972-161-0x00007FF8BFF33000-0x00007FF8BFF35000-memory.dmp

          Filesize

          8KB

        • memory/1972-162-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB

        • memory/1972-126-0x00000000003D0000-0x0000000000470000-memory.dmp

          Filesize

          640KB

        • memory/1972-164-0x00007FF8BFF30000-0x00007FF8C09F1000-memory.dmp

          Filesize

          10.8MB