Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 11:02
General
-
Target
Bloxflip Predictor.exe
-
Size
27KB
-
MD5
7bf897ca59b77ad3069c07149c35f97e
-
SHA1
6951dc20fa1e550ec9d066fe20e5100a9946a56b
-
SHA256
bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
-
SHA512
6e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
-
SSDEEP
384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxflip Predictor.exe"C:\Users\Admin\AppData\Local\Temp\Bloxflip Predictor.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD524c8b081057dde3fb93a40dd4cb2990d
SHA10670822ed20d0b808f3027f3cc8e4842bbe85232
SHA2560a46618b024e07c3c15b768125bd70882ee1f6dfb6ff4592144f07e28d5c6f1b
SHA5121378da182a165173b35ed1783dde5201df23a3f2415d73259cbf8d34572de1918739c31f27ce346135f1ca3237cca36fbaaba3237d6973f5b0c76116d44e9146
-
Filesize
1KB
MD569ab968db0b12dae68681deef9426241
SHA11d1b5d0ff75d3610ad73d0d5ec0a2476dc6e16a0
SHA256d59f9976085986ac5d2c93817333b89ff42a27cd91ef1938b16bc9b395075b6d
SHA512e4b9391114e936d09026f66bcd2ec44bbd2f00287446d772200c2db8e10d43b12af43d2743653f38678d228b14a96962ddb171f7e2b0a1cfa47da5b724d8de5e
-
Filesize
27KB
MD57bf897ca59b77ad3069c07149c35f97e
SHA16951dc20fa1e550ec9d066fe20e5100a9946a56b
SHA256bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
SHA5126e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB