Malware Analysis Report

2025-04-03 10:12

Sample ID 250214-2ef26szrez
Target 42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8
SHA256 42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8
Tags
blackshades discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8

Threat Level: Known bad

The file 42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8 was found to be: Known bad.

Malicious Activity Summary

blackshades discovery

Blackshades family

Blackshades payload

Downloads MZ/PE file

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-14 22:29

Signatures

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-14 22:29

Reported

2025-02-14 22:32

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe

"C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 48

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-14 22:29

Reported

2025-02-14 22:32

Platform

win10v2004-20250211-en

Max time kernel

104s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe"

Signatures

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe

"C:\Users\Admin\AppData\Local\Temp\42c1ae0ce552776a1c909f99029a8ab3219cadb0c29387658f302ce0e700ceb8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3648 -ip 3648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 232

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe

"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjExQURFNEQtREIwOS00M0Q4LTg4RjQtQzkxODYzN0REMUYyfSIgdXNlcmlkPSJ7NDY2NTY1OTYtQUU0MS00MjAwLUEzOUItQjY2M0M1MUVGM0U5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTFFNzgxNjAtN0QyOC00NUU3LTlFN0YtODVBMUJERUEwNDBEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODIxNjkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1MzE4NTEwMTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzQ5Mjk0OTY1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 msedge.api.cdp.microsoft.com udp
US 4.151.228.221:443 msedge.api.cdp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 199.232.214.172:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp

Files

N/A