Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 11:05
General
-
Target
BloxflipPredictor.exe
-
Size
27KB
-
MD5
7bf897ca59b77ad3069c07149c35f97e
-
SHA1
6951dc20fa1e550ec9d066fe20e5100a9946a56b
-
SHA256
bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
-
SHA512
6e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
-
SSDEEP
384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 5 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BloxflipPredictor.exe"C:\Users\Admin\AppData\Local\Temp\BloxflipPredictor.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Bloxflip Predictor.exe"C:\Windows\Bloxflip Predictor.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5673a9bfc7804a07c7366ec5d0b00361a
SHA19f0b4e270bd89e15c78af01f1be587271d6d692a
SHA256408dad851ba148ecc3dfc7dfbb37354777ea1e4eeddbee737eda8d99dfab6f23
SHA51257f11123be108eefd7651fc7421b3a98c83bec6782c81f66bec7489fe1c25c0f6cbd7d9b7a0a551f8201df020bb12e322e104eaa506a3631ab6c1507b0c77dc1
-
Filesize
1KB
MD51fb89c71e3ec30b565388e407ca44024
SHA159ff1cc02e0d6f090dfb8f86869988f618639f75
SHA25651101a07864f773ca8cc55f7b716bc73329bd3b74444d1e1c5e3ba0b22a42b7d
SHA51203bc06f91891d17787dc2133c14ba3f89e39102fa07ac758bfdd83d37318dcedc4aa8a62436b180f7685dd30b1e3f5e8d1d7050dcc3d833cc57165bc4471fd8d
-
Filesize
27KB
MD57bf897ca59b77ad3069c07149c35f97e
SHA16951dc20fa1e550ec9d066fe20e5100a9946a56b
SHA256bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
SHA5126e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB