Resubmissions
20-12-2024 18:09
241220-wrh5ea1lcx 619-12-2024 22:21
241219-1923fssjhq 619-12-2024 22:19
241219-18x24ssjfl 617-12-2024 16:11
241217-tneayatnbm 1002-12-2024 04:02
241202-el979stpdr 6Analysis
-
max time kernel
48s -
max time network
49s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
19-12-2024 22:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Bloxxed_v1 (1).exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
General
-
Target
Bloxxed_v1 (1).exe
-
Size
172KB
-
MD5
66ddf5e574409a5999cc1dc528cc200a
-
SHA1
fd10666096fd8f56f7ff43fc13206a67d417c290
-
SHA256
56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3
-
SHA512
e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc
-
SSDEEP
3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Bloxxed_v1 (1).exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4008 taskmgr.exe Token: SeSystemProfilePrivilege 4008 taskmgr.exe Token: SeCreateGlobalPrivilege 4008 taskmgr.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe 4008 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1852 1600 Bloxxed_v1 (1).exe 81 PID 1600 wrote to memory of 1852 1600 Bloxxed_v1 (1).exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe"C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SYSTEM32\cmd.execmd /c bloxxedbyfronbypass1.93.bat2⤵PID:1852
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4008