Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 19:25
General
- Target blockyfish-4.4.1-windows-x64.exe
- Size 92.8MB
- Sample260503-x451daf141
- SHA256 821371a376219a37a23f056e534fd1f7721edc61f5a36c0a9eed9b4288b71d81
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 25 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Drops file in System32 directory 2 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\blockyfish-4.4.1-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\blockyfish-4.4.1-windows-x64.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"2⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Blockyfish', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe"C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe"C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockyfish" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1744,i,569322694420133369,17196813317028646234,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1748,i,14281896310722962498,4346040681108900174,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1740 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe"C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockyfish" --field-trial-handle=1744,i,569322694420133369,17196813317028646234,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1748,i,14281896310722962498,4346040681108900174,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2004 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe"C:\Users\Admin\AppData\Local\Programs\Blockyfish\Blockyfish.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Blockyfish" --app-path="C:\Users\Admin\AppData\Local\Programs\Blockyfish\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1744,i,569322694420133369,17196813317028646234,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1748,i,14281896310722962498,4346040681108900174,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3180 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_u5evgksj.qnc.ps1
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
app.asar
snapshot_blob.bin
v8_context_snapshot.bin
version
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
NSIS_SkinCrafter_Plugin.dll
SkinCrafter.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
the-real-index
the-real-index
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State
CURRENT
default.dic
mfc71.dll
msvcr71.dll
memory/460-110-0x0000000004C50000-0x0000000004C97000-memory.dmp
memory/460-89-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/460-90-0x00000000022B0000-0x00000000022C0000-memory.dmp
memory/460-108-0x0000000007170000-0x0000000007181000-memory.dmp
memory/460-107-0x0000000007200000-0x0000000007296000-memory.dmp
memory/460-99-0x000000006FF10000-0x000000006FF5C000-memory.dmp
memory/2320-536-0x000002006D290000-0x000002006D33D000-memory.dmp
memory/2784-528-0x0000021E449C0000-0x0000021E44A6D000-memory.dmp
memory/3552-133-0x0000000005910000-0x0000000005957000-memory.dmp
memory/3552-121-0x0000000006590000-0x00000000068E4000-memory.dmp
memory/3552-131-0x0000000070070000-0x00000000703C4000-memory.dmp
memory/3552-123-0x000000006FF10000-0x000000006FF5C000-memory.dmp
memory/4748-12-0x0000000002A50000-0x0000000002B1C000-memory.dmp
memory/4852-537-0x000001FFD9BE0000-0x000001FFD9C0B000-memory.dmp
memory/4852-414-0x00007FFF8B6D0000-0x00007FFF8B6D1000-memory.dmp
memory/4852-415-0x000001FFD9D40000-0x000001FFD9D41000-memory.dmp
memory/5424-64-0x000000006FF10000-0x000000006FF5C000-memory.dmp
memory/5424-51-0x00000000061C0000-0x0000000006226000-memory.dmp
memory/5424-72-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/5424-73-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/5424-74-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/5424-76-0x0000000008150000-0x00000000087CA000-memory.dmp
memory/5424-63-0x00000000077B0000-0x00000000077E2000-memory.dmp
memory/5424-62-0x000000007F4A0000-0x000000007F4B0000-memory.dmp
memory/5424-61-0x0000000006850000-0x000000000689C000-memory.dmp
memory/5424-60-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/5424-77-0x0000000007B00000-0x0000000007B1A000-memory.dmp
memory/5424-78-0x0000000007B70000-0x0000000007B7A000-memory.dmp
memory/5424-59-0x0000000006230000-0x0000000006584000-memory.dmp
memory/5424-75-0x00000000077F0000-0x0000000007893000-memory.dmp
memory/5424-50-0x00000000060E0000-0x0000000006146000-memory.dmp
memory/5424-49-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/5424-48-0x0000000005830000-0x0000000005E58000-memory.dmp
memory/5424-79-0x0000000007CF0000-0x0000000007D1A000-memory.dmp
memory/5424-84-0x0000000005F60000-0x0000000005FA7000-memory.dmp
memory/5424-80-0x0000000007D20000-0x0000000007D44000-memory.dmp
memory/5424-81-0x0000000070690000-0x00000000709E4000-memory.dmp
memory/5424-47-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/5424-46-0x00000000051C0000-0x00000000051F6000-memory.dmp
memory/5424-45-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/5776-531-0x0000020AADC80000-0x0000020AADD2D000-memory.dmp