Overview

overview

7

Static

static

3

blur-Windo...64.exe

windows10-2004-x64

blur-Windo...64.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    67s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 19:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    blur-Windows-Installer-x64.exe
  • Size 171.9MB
  • Sample260730-x4f19aed74
  • SHA256 fe9c30fefae035c4edb1ef22fea2792e0cf69cccdf952f864f5305a61f40892b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstallerpersistenceransomware

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\blur-Windows-Installer-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\blur-Windows-Installer-x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\is-PAWIIW1OCP.tmp\blur-Windows-Installer-x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PAWIIW1OCP.tmp\blur-Windows-Installer-x64.tmp" /SL5="$802A4,179018200,941056,C:\Users\Admin\AppData\Local\Temp\blur-Windows-Installer-x64.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2432
      • C:\Users\Admin\AppData\Local\Temp\is-RO3B3SF9FX.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-RO3B3SF9FX.tmp\VC_redist.x64.exe" /install /passive /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\Temp\{7C442095-10E9-4952-B274-8C0344305885}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{7C442095-10E9-4952-B274-8C0344305885}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-RO3B3SF9FX.tmp\VC_redist.x64.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696 /install /passive /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{4F30CDD3-263D-42D2-8F47-33830488CAC5} {4CE237D1-D3F0-4FAB-8819-7DD9916D1B77} 2076
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:764
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{1CC53B95-3EA6-4F60-A99A-3644742CAB1F} {F435BCAC-7D14-4281-AE8F-67DA7C03CB9E} 764
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3628
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1152 -burn.embedded BurnPipe.{1CC53B95-3EA6-4F60-A99A-3644742CAB1F} {F435BCAC-7D14-4281-AE8F-67DA7C03CB9E} 764
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2156
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E2726D4E-4398-4795-B23C-E6005FACFCA8} {9D3CE464-C3E4-445D-855E-21FADBC6062F} 2156
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4648
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2444
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4056
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1484
  • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730202836.log" /install
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=524 -burn.filehandle.self=544 /passive /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730202836.log" /install
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D8C497BB-827E-4810-8FCE-C89D115F3297} {5054F4B3-5D7D-4047-97CB-05FF83556980} 4776
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:2556
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa396c055 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:204

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e595cc1.rbs
        • Path C:\Config.Msi\e595cc1.rbs
        • Size 19KB
        • SHA256 cd96aa774d1e376847f03df1fb37cc07341d38ab379265f5febc085bac04172b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e595ccd.rbs
        • Path C:\Config.Msi\e595ccd.rbs
        • Size 19KB
        • SHA256 fce314ce94e200cc1c6741b65c75543029be82b52733e19a332f942323129ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e595cd4.rbs
        • Path C:\Config.Msi\e595cd4.rbs
        • Size 21KB
        • SHA256 4e4d116ac522f986d275b3d7ee9749ec6b2466910653d3f2577c499f0d7ee2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e595ce3.rbs
        • Path C:\Config.Msi\e595ce3.rbs
        • Size 21KB
        • SHA256 7f2211bf5320157eca08a936b5ee63dd6bf085b1bc001f2d820428189f79fa48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-30IGRPGNM0.tmp
        • Path C:\Program Files (x86)\blur\lib\vapoursynth\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\packaging\is-30IGRPGNM0.tmp
        • Size 9KB
        • SHA256 0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        is-GNVXOCYCL1.tmp
        • Path C:\Program Files (x86)\blur\lib\vapoursynth\Lib\site-packages\pip-26.1.1.dist-info\licenses\src\pip\_vendor\tomli\is-GNVXOCYCL1.tmp
        • Size 1KB
        • SHA256 b80816b0d530b8accb4c2211783790984a6e3b61922c2b5ee92f3372ab2742fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
        • Size 1000B
        • SHA256 51e32bcb74652c9e7cc8d8f9b3e1c7c7a9ac7d07a3a7f5665b33bc814a1dd97e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        state.rsm
        • Path C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\state.rsm
        • Size 980B
        • SHA256 91397ff5a2bcc623d47c87f1831aa217ca7e099368fd1089875c54e0f30dee48
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dd_vcredist_amd64_20260730202836_000_vcRuntimeMinimum_x64.log
        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730202836_000_vcRuntimeMinimum_x64.log
        • Size 2KB
        • SHA256 96b68f3bc7d4aeadabd54490201e21559fa66959ba82c5f69bd47d5e5ca67f9a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dd_vcredist_amd64_20260730202836_001_vcRuntimeAdditional_x64.log
        • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260730202836_001_vcRuntimeAdditional_x64.log
        • Size 2KB
        • SHA256 81e13f4a67f032f1abd11b800d5d8e06e533f5214381647fe37c22dfd121c700
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        blur-Windows-Installer-x64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-PAWIIW1OCP.tmp\blur-Windows-Installer-x64.tmp
        • Size 4.2MB
        • SHA256 c6bcf72114a88746d47872a16394295a1997066eb5cf798f03c4300eb3ebf0d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-RO3B3SF9FX.tmp\VC_redist.x64.exe
        • Size 24.4MB
        • SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        license.rtf
        • Path C:\Windows\Temp\{45D68681-620D-48F8-B6B3-9CE247C57346}\.ba\license.rtf
        • Size 9KB
        • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        thm.wxl
        • Path C:\Windows\Temp\{45D68681-620D-48F8-B6B3-9CE247C57346}\.ba\thm.wxl
        • Size 2KB
        • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        thm.xml
        • Path C:\Windows\Temp\{45D68681-620D-48F8-B6B3-9CE247C57346}\.ba\thm.xml
        • Size 8KB
        • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{45D68681-620D-48F8-B6B3-9CE247C57346}\.ba\wixstdba.dll
        • Size 191KB
        • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VC_redist.x64.exe
        • Path C:\Windows\Temp\{7C442095-10E9-4952-B274-8C0344305885}\.cr\VC_redist.x64.exe
        • Size 670KB
        • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\.ba\logo.png
        • Size 1KB
        • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wixstdba.dll
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\.ba\wixstdba.dll
        • Size 215KB
        • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab2C04DDC374BD96EB5C8EB8208F2C7C92
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
        • Size 5.4MB
        • SHA256 7dee5b77719fb6a6627145357c5a93bf8af2a9de54d34c79ffc1ae71d52c79f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cab5046A8AB272BF37297BB7928664C9503
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\cab5046A8AB272BF37297BB7928664C9503
        • Size 964KB
        • SHA256 640aa6c516c72444523b8fbe034db46ff4e118ed02705340e3ccb62d426ff040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcRuntimeAdditional_x64
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\vcRuntimeAdditional_x64
        • Size 208KB
        • SHA256 7df26ee2169ef6c61c17675e1a2edbaf01bca2ed1a0bdc0f8396d029a336c1f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcRuntimeMinimum_x64
        • Path C:\Windows\Temp\{B02FCE94-3595-4074-8211-BAD176A437D9}\vcRuntimeMinimum_x64
        • Size 208KB
        • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2156-2158-0x00000000003D0000-0x0000000000447000-memory.dmp
        Download

        memory/2432-1977-0x0000000000C60000-0x00000000010AF000-memory.dmp
        Download

        memory/2432-32-0x00000000017D0000-0x00000000017D1000-memory.dmp
        Download

        memory/2432-31-0x0000000000C60000-0x00000000010AF000-memory.dmp
        Download

        memory/2432-674-0x0000000000C60000-0x00000000010AF000-memory.dmp
        Download

        memory/2432-5-0x00000000017D0000-0x00000000017D1000-memory.dmp
        Download

        memory/2432-2168-0x0000000000C60000-0x00000000010AF000-memory.dmp
        Download

        memory/2432-2170-0x0000000000C60000-0x00000000010AF000-memory.dmp
        Download

        memory/3628-2159-0x00000000003D0000-0x0000000000447000-memory.dmp
        Download

        memory/4284-30-0x0000000000630000-0x0000000000724000-memory.dmp
        Download

        memory/4284-0-0x0000000000630000-0x0000000000724000-memory.dmp
        Download

        memory/4284-2171-0x0000000000630000-0x0000000000724000-memory.dmp
        Download

        memory/4648-2156-0x00000000003D0000-0x0000000000447000-memory.dmp
        Download