Overview

overview

8

Static

static

3

blackdf7.exe

windows10-2004-x64

8

blackdf7.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/10/2026, 18:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    blackdf7.exe
  • Size 30.2MB
  • Sample261030-w7tabafc63
  • SHA256 b6a4d8fbe8b25c2f2ed9b074794fdfb676d44e203cc241453a224444504ef42c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecution

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 17 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\blackdf7.exe
    "C:\Users\Admin\AppData\Local\Temp\blackdf7.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:392
    • C:\Users\Admin\AppData\Local\KOK\ddc.exe
      "C:\Users\Admin\AppData\Local\KOK\ddc.exe" -i
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c PAUSE
        3⤵
        • Executes a command shell one-liner
        PID:2388
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cd6dc8a3-0e12-9c41-bb05-ac44439473ac}\ddhid60400.inf" "9" "431571df3" "0000000000000140" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\kok"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:440
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818f8328d09:ddhid60400.Inst:8.8.8.8:ddhid60400\hid_device," "431571df3" "0000000000000154"
      2⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4624
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2708
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbfea6c728,0x7ffbfea6c734,0x7ffbfea6c740
      2⤵
        PID:2640
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,2585077828109923544,11858696089581447956,262144 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:1416
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,18095787033191463209,5046868245477896347,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • System Time Discovery
          PID:3364
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2460,i,9783699911343757366,26929647381692162,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2608 /prefetch:8
          2⤵
            PID:2092
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,18152624429446307026,11778329200133175411,2097152 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3256 /prefetch:1
            2⤵
              PID:5112
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,4593815673176529058,2608902989451730901,2097152 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:2892
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4536,i,15671619590902401328,14660622423821397931,2097152 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4560 /prefetch:1
                2⤵
                  PID:3388
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,5276754346141704522,990268175853026596,2097152 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4768 /prefetch:1
                  2⤵
                    PID:3668
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15288200377546997175,4434181044860954505,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5536 /prefetch:8
                    2⤵
                      PID:3372
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,2596959231251697181,8046745883169710232,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5868 /prefetch:8
                      2⤵
                        PID:2972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,9300013409167075217,9838760662217764921,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5932 /prefetch:8
                        2⤵
                          PID:1700
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,6852671281845194091,10436796429713037752,524288 --field-trial-handle=1836,i,2570227117945294329,5594324755791713122,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6008 /prefetch:8
                          2⤵
                            PID:1996
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:868
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:4280

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  2ebedfa8-6ef5-4fbe-b038-2ffff5f83ceb.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2ebedfa8-6ef5-4fbe-b038-2ffff5f83ceb.tmp
                                  • Size 270KB
                                  • SHA256 5741147ad91e118c4a31681b524dedcecc9686ddb1a1028418a4f94d885fe72e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  34f3cd3b-0b29-4d2d-b09f-c080f84604bc.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34f3cd3b-0b29-4d2d-b09f-c080f84604bc.tmp
                                  • Size 270KB
                                  • SHA256 19db5227ae745e75419a0dad106124e3de9b693606e10a6ba3d643c65eaf5a68
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  80ec0ace-2e3d-414a-bd28-ada6f5aa8e71.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\80ec0ace-2e3d-414a-bd28-ada6f5aa8e71.tmp
                                  • Size 130KB
                                  • SHA256 8f04516fdc1c00600ea412b65a69a9502789464a2aa2123a58f81909500cbf21
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  3892114d-6fd3-4116-9754-7844560234a4.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3892114d-6fd3-4116-9754-7844560234a4.tmp
                                  • Size 13KB
                                  • SHA256 eff4472df129bc4e2b803cc39a1ba520374d3b607d22cd6393104a3be124b9c2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  57d63aa9-602d-4d97-b89c-f95729c8cbf8.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57d63aa9-602d-4d97-b89c-f95729c8cbf8.tmp
                                  • Size 414B
                                  • SHA256 123f652b07064e4fbdef5cc0c5eab412d8bae895ba7b66c8dd70435e259d2476
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  7071289a-1984-44cb-be05-92044d75020c.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7071289a-1984-44cb-be05-92044d75020c.tmp
                                  • Size 12KB
                                  • SHA256 59a17a263b4c01560236068cb1db3c4def12394556452e5f094aea6946df540b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  temp-index
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
                                  • Size 264B
                                  • SHA256 8394d77a18006220a925a275a711c48fe8cf22f7568ae6326c427e5ec6bab9af
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  2e54c0bb-4c01-4bb0-bd44-75b038dbe92c.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2e54c0bb-4c01-4bb0-bd44-75b038dbe92c.tmp
                                  • Size 3KB
                                  • SHA256 2fd9957f5776c22b109a59e883361febab89d520e382bdc22e895e9f748943e3
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  e1af9b2d-46c9-43a9-abb1-b622c462c11e.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e1af9b2d-46c9-43a9-abb1-b622c462c11e.tmp
                                  • Size 11KB
                                  • SHA256 9a860c92076a508305208b789a1798a5f1a2bcefba8ef0b89d1fd8c6e1f97555
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  e5fa871e-6cab-4fb4-bfd0-9417798f62d1.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e5fa871e-6cab-4fb4-bfd0-9417798f62d1.tmp
                                  • Size 6B
                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  edeeff2b-8ba8-43f1-8940-cfebe96018f1.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\edeeff2b-8ba8-43f1-8940-cfebe96018f1.tmp
                                  • Size 12KB
                                  • SHA256 b7a600d3c71e00e645436b8448c2cacf21296d4047bc8964c7da9e4e08808ab9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  fc996d49-fdbc-44de-899d-ef0aa7280dae.tmp
                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fc996d49-fdbc-44de-899d-ef0aa7280dae.tmp
                                  • Size 271KB
                                  • SHA256 b103e1160bdff9d463bf641356f9f7220e497b1d4290f41b6a786e28c59e0062
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ddc.exe
                                  • Path C:\Users\Admin\AppData\Local\KOK\ddc.exe
                                  • Size 94KB
                                  • SHA256 3c535b334f0897b8a0870bcb476c30ea79afd09cfc18f8e00190bdc7c6c46785
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ddhid60400.dll
                                  • Path C:\Users\Admin\AppData\Local\KOK\ddhid60400.dll
                                  • Size 2.4MB
                                  • SHA256 fab524fbb18425d240f556d74c9e26c74ce51ce46f6998fcec189ee64502beac
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ddhid60400.inf
                                  • Path C:\Users\Admin\AppData\Local\KOK\ddhid60400.inf
                                  • Size 1KB
                                  • SHA256 1cfefc2282ad6bfcfe9051e9759d38ff84d72a7469b098c4fe29d662face8a45
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  DDHID6~1.SYS
                                  • Path \??\c:\users\admin\appdata\local\kok\DDHID6~1.SYS
                                  • Size 1.3MB
                                  • SHA256 482b0711633fc81c88d809a67c048221a27ae8bd75f9e04daa9a942d0589923d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ddhid60400.cat
                                  • Path \??\c:\users\admin\appdata\local\kok\ddhid60400.cat
                                  • Size 11KB
                                  • SHA256 528ea52924a9977fa0bc8ff6a6c7ac9e9e664ea3ff023e99a32b24b807e7f814
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download