Overview

overview

6

Static

static

3

Bloxxed_v1 (1).exe

windows11-21h2-x64

6

Resubmissions

20-12-2024 18:09

241220-wrh5ea1lcx 6

19-12-2024 22:21

241219-1923fssjhq 6

19-12-2024 22:19

241219-18x24ssjfl 6

17-12-2024 16:11

241217-tneayatnbm 10

02-12-2024 04:02

241202-el979stpdr 6

Analysis

  • max time kernel
    84s
  • max time network
    76s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-12-2024 22:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bloxxed_v1 (1).exe

  • Size

    172KB

  • MD5

    66ddf5e574409a5999cc1dc528cc200a

  • SHA1

    fd10666096fd8f56f7ff43fc13206a67d417c290

  • SHA256

    56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3

  • SHA512

    e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc

  • SSDEEP

    3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:128
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c bloxxedbyfronbypass1.93.bat
      2⤵
        PID:4480
    • C:\Windows\system32\control.exe
      "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:5020
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:1248
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        2⤵
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3084
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5008
      • C:\Windows\System32\warvpk.exe
        "C:\Windows\System32\warvpk.exe"
        1⤵
          PID:3532
        • C:\Windows\System32\warvpk.exe
          "C:\Windows\System32\warvpk.exe"
          1⤵
            PID:3124

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
            Filesize

            14KB

            MD5

            297cd6e1c46fa5c8e8a48fca13c68805

            SHA1

            de5c7afb932262c98b555b571e66a20f5046393b

            SHA256

            c44412a9c4e0d19828e82d92bb56d604c461712c773548452280bdbac2f3fb96

            SHA512

            7d550c6bdb85196898201420e89419fae357d94517b5dff945cfbaab989b3e39dd6b7f6911833bc3d1ccc192b276f0b1a4d7998bb8ae37e81a4bfe9851cadc53

            Download Submit

          • memory/3084-10-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-12-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-11-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-16-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-18-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-17-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-19-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-22-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-21-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3084-20-0x0000021FFC8C0000-0x0000021FFC8C1000-memory.dmp

            Filesize

            4KB

            Download