56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3

Resubmissions

20-12-2024 18:09

241220-wrh5ea1lcx 6

19-12-2024 22:21

19-12-2024 22:19

17-12-2024 16:11

02-12-2024 04:02

Analysis

max time kernel
46s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bloxxed_v1 (1).exe
Size

172KB
MD5

66ddf5e574409a5999cc1dc528cc200a
SHA1

fd10666096fd8f56f7ff43fc13206a67d417c290
SHA256

56d9cb781bcc6ec4aa4933c98e8451d0ccbe41cfea832367dc4792fdf39603a3
SHA512

e4d4056e85ddb1f47ece180ea65864723c907fd233f9a2619be8f7b59291065c09d7c66160662a4be19797e2f9a9cc063895e771ddc97688c6dd366651ed66bc
SSDEEP

3072:GMobR7ezAjLOZvmX1i5GWp1icKAArDZz4N9GhbkrNEk1LzB:beR7eammGp0yN90QEs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Bloxxed_v1 (1).exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	mspaint.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1076	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	mspaint.exe
4448	mspaint.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4448	mspaint.exe
3568	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 4492	3592	Bloxxed_v1 (1).exe	82
PID 3592 wrote to memory of 4492	3592	Bloxxed_v1 (1).exe	82

C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe
"C:\Users\Admin\AppData\Local\Temp\Bloxxed_v1 (1).exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bloxxedbyfronbypass1.93.bat
  2⤵
  PID:4492

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UndoApprove.jpeg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:4520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3568

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe" "C:\Users\Admin\Desktop\MeasureOptimize.ps1"
1⤵
- Opens file in notepad (likely ransom note)
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4520-9-0x000002B97FD70000-0x000002B97FD80000-memory.dmp

Filesize
64KB

Download
memory/4520-4-0x000002B97F3C0000-0x000002B97F3D0000-memory.dmp

Filesize
64KB

Download
memory/4520-15-0x000002B908050000-0x000002B908051000-memory.dmp

Filesize
4KB

Download
memory/4520-17-0x000002B9080D0000-0x000002B9080D1000-memory.dmp

Filesize
4KB

Download
memory/4520-19-0x000002B9080D0000-0x000002B9080D1000-memory.dmp

Filesize
4KB

Download
memory/4520-20-0x000002B908160000-0x000002B908161000-memory.dmp

Filesize
4KB

Download
memory/4520-21-0x000002B908160000-0x000002B908161000-memory.dmp

Filesize
4KB

Download
memory/4520-22-0x000002B908170000-0x000002B908171000-memory.dmp

Filesize
4KB

Download
memory/4520-23-0x000002B908170000-0x000002B908171000-memory.dmp

Filesize
4KB

Download