File name:

BlackBit.exe

Full analysis: https://app.any.run/tasks/19bdbd94-91ae-4e85-b30b-d44aa25060ec
Verdict: Malicious activity
Analysis date: November 12, 2023, 11:36:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7EF84720D7B30286BFF9483FE53BBA62

SHA1:

B8DBB845CC37FA555D5A3F52E4BBB76AA2BE0933

SHA256:

9763DA5EE688A2391599A22638A84CBC7F99E32CD6865EAC4621CC427F6C3A63

SSDEEP:

12288:Dh1Lk70Tnvjcg27dWy1fX6qOLzvkLek4v+KXdPeA:fk70TrcbT56qOHv31PJv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BlackBit.exe (PID: 3196)
      • csc.exe (PID: 3660)
      • csc.exe (PID: 3908)
      • BlackBit.exe (PID: 3812)

    • Create files in the Startup directory

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 3596)

    • Starts Visual C# compiler

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)

    • Deletes shadow copies

      • cmd.exe (PID: 4016)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 3892)
      • cmd.exe (PID: 3972)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 3536)
      • cmd.exe (PID: 4056)

    • Disables Windows Defender

      • BlackBit.exe (PID: 3812)

  • SUSPICIOUS

    • Reads the Internet Settings

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)
      • WMIC.exe (PID: 3788)
      • 34z5kfkj.exe (PID: 2932)
      • mshta.exe (PID: 1904)
      • 34z5kfkj.exe (PID: 3264)
      • mshta.exe (PID: 2460)

    • Starts CMD.EXE for commands execution

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)

    • Uses .NET C# to load dll

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)

    • Application launched itself

      • BlackBit.exe (PID: 3196)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 3712)
      • cmd.exe (PID: 4068)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1528)
      • wbengine.exe (PID: 1296)
      • vds.exe (PID: 1928)

    • Uses pipe srvsvc via SMB (transferring data)

      • BlackBit.exe (PID: 3812)

    • Write to the desktop.ini file (may be used to cloak folders)

      • BlackBit.exe (PID: 3812)

    • Checks for external IP

      • BlackBit.exe (PID: 3812)

  • INFO

    • Reads the computer name

      • BlackBit.exe (PID: 3196)
      • BlackBit.exe (PID: 3812)
      • 34z5kfkj.exe (PID: 2932)
      • 34z5kfkj.exe (PID: 3264)

    • Checks supported languages

      • BlackBit.exe (PID: 3196)
      • csc.exe (PID: 3660)
      • cvtres.exe (PID: 3888)
      • BlackBit.exe (PID: 3812)
      • csc.exe (PID: 3908)
      • cvtres.exe (PID: 3728)
      • 34z5kfkj.exe (PID: 3264)
      • 34z5kfkj.exe (PID: 2932)

    • Reads the machine GUID from the registry

      • BlackBit.exe (PID: 3196)
      • csc.exe (PID: 3660)
      • cvtres.exe (PID: 3888)
      • BlackBit.exe (PID: 3812)
      • csc.exe (PID: 3908)
      • cvtres.exe (PID: 3728)

    • Creates files in the program directory

      • BlackBit.exe (PID: 3196)
      • csc.exe (PID: 3660)
      • BlackBit.exe (PID: 3812)
      • csc.exe (PID: 3908)

    • Creates files or folders in the user directory

      • BlackBit.exe (PID: 3196)

    • Create files in a temporary directory

      • BlackBit.exe (PID: 3196)
      • cvtres.exe (PID: 3888)
      • BlackBit.exe (PID: 3812)
      • cvtres.exe (PID: 3728)

    • Checks proxy server information

      • BlackBit.exe (PID: 3812)
      • mshta.exe (PID: 1904)
      • mshta.exe (PID: 2460)

    • Reads Environment values

      • BlackBit.exe (PID: 3812)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 1904)
      • mshta.exe (PID: 2460)

    • Manual execution by a user

      • 34z5kfkj.exe (PID: 3264)
      • 34z5kfkj.exe (PID: 2932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:07:14 00:47:16+02:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 104448
InitializedDataSize: 405504
UninitializedDataSize: -
EntryPoint: 0xcd2f
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft
FileDescription: svchost
FileVersion: 1.0.0.0
InternalName: svchost.exe
LegalCopyright: Copyright © 2021
LegalTrademarks: -
OriginalFileName: svchost.exe
ProductName: svchost
ProductVersion: 1.0.0.0
AssemblyVersion: 1.2.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
35
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start blackbit.exe cmd.exe schtasks.exe no specs csc.exe no specs cvtres.exe no specs blackbit.exe csc.exe no specs cvtres.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs vssadmin.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs wbadmin.exe no specs wbadmin.exe no specs bcdedit.exe no specs vssvc.exe no specs bcdedit.exe no specs netsh.exe no specs netsh.exe no specs wbengine.exe no specs SPPSurrogate no specs vdsldr.exe no specs vds.exe no specs 34z5kfkj.exe no specs mshta.exe no specs 34z5kfkj.exe no specs mshta.exe no specs PhotoViewer.dll no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300bcdedit /set {default} recoveryenabled noC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1296"C:\Windows\system32\wbengine.exe"C:\Windows\System32\wbengine.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Block Level Backup Engine Service EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbengine.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1352netsh firewall set opmode mode=disableC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1528C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1560C:\Windows\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
1756netsh advfirewall set currentprofile state offC:\Windows\System32\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1904C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1904"C:\Windows\System32\mshta.exe" "C:\ProgramData\info.BlackBit"C:\Windows\System32\mshta.exe—34z5kfkj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1928C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\atl.dll
2196bcdedit /set {default} bootstatuspolicy ignoreallfailuresC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 024
Read events
4 781
Write events
243
Delete events
0

Modification events

(PID) Process:(3196) BlackBit.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3196) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3196) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3196) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3196) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3812) BlackBit.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3812) BlackBit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
115
(PID) Process:(3812) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3812) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3812) BlackBit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
21
Suspicious files
2 519
Text files
430
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196BlackBit.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exeexecutable
MD5:7EF84720D7B30286BFF9483FE53BBA62
SHA256:9763DA5EE688A2391599A22638A84CBC7F99E32CD6865EAC4621CC427F6C3A63
3196BlackBit.exeC:\Users\admin\AppData\Roaming\winlogon.exeexecutable
MD5:7EF84720D7B30286BFF9483FE53BBA62
SHA256:9763DA5EE688A2391599A22638A84CBC7F99E32CD6865EAC4621CC427F6C3A63
3196BlackBit.exeC:\Users\admin\AppData\Local\Temp\dtno1n4e.cmdlinetext
MD5:66AB00F8D8A0D553C90B6D55AA3AE0C7
SHA256:B43AC3182150AA78F517D8CA4822727DC83349F5259E131EE701EABFDCDC1DDC
3196BlackBit.exeC:\ProgramData\winlogon.exeexecutable
MD5:7EF84720D7B30286BFF9483FE53BBA62
SHA256:9763DA5EE688A2391599A22638A84CBC7F99E32CD6865EAC4621CC427F6C3A63
3196BlackBit.exeC:\Users\admin\AppData\Local\Temp\y2rtz4lf.icoimage
MD5:305C2042777E67710483E58ACC04AC2C
SHA256:F9DDF619CA0266055744C2BECA77673AA41702104B459A0F55DE3945196B6C50
3196BlackBit.exeC:\Users\admin\AppData\Local\Temp\dtno1n4e.0.cstext
MD5:ED3B14701505E0AFC3B3601A186723B1
SHA256:5B346C3CCD41B371738DDC925296203D504B4F5F47E2FE0D9F37533C1E6AB4E9
3196BlackBit.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wvtymcow.battext
MD5:3FC537B642D3756646715325299C6367
SHA256:708511C356493E41CA103DB51B8DF3FB57898DDB2BB7CF4F11560FACDE9425ED
3908csc.exeC:\ProgramData\CSCCC606B3D18CE4BC9994CBBC4FA4A5CCA.TMPbinary
MD5:9E9355216A06FAD6AD58DB5D7B725456
SHA256:DDC26A5F5175666934DDDBC86BAEBE103F81C13F996129EA30F629486B1BDA36
3812BlackBit.exeC:\Users\admin\AppData\Local\Temp\fivqqdww.0.cstext
MD5:ED3B14701505E0AFC3B3601A186723B1
SHA256:5B346C3CCD41B371738DDC925296203D504B4F5F47E2FE0D9F37533C1E6AB4E9
3812BlackBit.exeC:\Users\admin\AppData\Local\Temp\mgasqjay.icoimage
MD5:305C2042777E67710483E58ACC04AC2C
SHA256:F9DDF619CA0266055744C2BECA77673AA41702104B459A0F55DE3945196B6C50
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
17
DNS requests
2
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3812
BlackBit.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
binary
293 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.1:445
—
—
—
unknown
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
192.168.100.2:139
—
—
—
whitelisted
4
System
192.168.100.1:139
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.2:137
—
—
—
whitelisted
4
System
192.168.100.1:137
—
—
—
unknown
3812
BlackBit.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown

DNS requests

Domain
IP
Reputation
application-api.xyz
  • —
unknown
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
3812
BlackBit.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3812
BlackBit.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BlackBit.exe