56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3

Resubmissions

20-12-2024 18:09

241220-wrh5ea1lcx 6

19-12-2024 22:21

19-12-2024 22:19

17-12-2024 16:11

02-12-2024 04:02

Analysis

max time kernel
0s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-12-2024 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloxxed_v1 (1).exe
Size

172KB
MD5

66ddf5e574409a5999cc1dc528cc200a
SHA1

fd10666096fd8f56f7ff43fc13206a67d417c290
SHA256

56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3
SHA512

e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc
SSDEEP

3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Bloxxed_v1 (1).exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 4516	2012	Bloxxed_v1 (1).exe	77
PID 2012 wrote to memory of 4516	2012	Bloxxed_v1 (1).exe	77

C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe
"C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bloxxedbyfronbypass1.93.bat
  2⤵
  PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads