Analysis date (UTC): 18 April 2022, 22:06Analysis environment: Windows 7 Pro, build 7601, x86

BlackSun.exe

MD5:AC5E5F40CAEFA1AC89C39BD20DE60005

SHA1:A69120D342A160E20185FA41546AD4A32CF3B83B

SHA256:CAA35E43F44CEE74A5189876C4EBD67C1221DCA6A88B50E9A403A67F39E394B7

Analysis result

Threat level:Malicious activity

Full analysis:Analysis BlackSun.exe (MD5: AC5E5F40CAEFA1AC89C39BD20DE60005) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops executable file immediately after starts

chrome.exe (PID: 2712)
directx_Jun2010_redist.exe (PID: 1272)
directx_Jun2010_redist.exe (PID: 752)
DXSETUP.exe (PID: 2148)

Application was dropped or rewritten from another process

directx_Jun2010_redist.exe (PID: 1272)
directx_Jun2010_redist.exe (PID: 752)
DXSETUP.exe (PID: 3540)
DXSETUP.exe (PID: 2148)

Loads dropped or rewritten executable

DXSETUP.exe (PID: 2148)
BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Changes settings of System certificates

BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Writes to the hosts file

BlackSun.exe (PID: 2124)

SUSPICIOUS

Modifies files in Chrome extension folder

chrome.exe (PID: 2712)

Executable content was dropped or overwritten

chrome.exe (PID: 2712)
directx_Jun2010_redist.exe (PID: 1272)
directx_Jun2010_redist.exe (PID: 752)
DXSETUP.exe (PID: 2148)

Drops a file with a compile date too recent

chrome.exe (PID: 2712)
directx_Jun2010_redist.exe (PID: 1272)
directx_Jun2010_redist.exe (PID: 752)
DXSETUP.exe (PID: 2148)

Checks supported languages

directx_Jun2010_redist.exe (PID: 1272)
DXSETUP.exe (PID: 2148)
BlackSun.exe (PID: 2124)
directx_Jun2010_redist.exe (PID: 752)
BlackSun.exe (PID: 3480)

Reads the computer name

directx_Jun2010_redist.exe (PID: 1272)
DXSETUP.exe (PID: 2148)
BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Executed via COM

DllHost.exe (PID: 2652)
DllHost.exe (PID: 1460)

Executed as Windows Service

vssvc.exe (PID: 1256)

Reads Environment values

vssvc.exe (PID: 1256)
netsh.exe (PID: 2360)
netsh.exe (PID: 1804)
netsh.exe (PID: 2284)
netsh.exe (PID: 2532)
netsh.exe (PID: 2028)
netsh.exe (PID: 2692)
netsh.exe (PID: 3300)
netsh.exe (PID: 3352)
netsh.exe (PID: 624)
netsh.exe (PID: 120)

Creates/Modifies COM task schedule object

DXSETUP.exe (PID: 2148)

Searches for installed software

DllHost.exe (PID: 1460)
DXSETUP.exe (PID: 2148)

Removes files from Windows directory

DXSETUP.exe (PID: 2148)

Uses NETSH.EXE for network configuration

BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Creates files in the Windows directory

DXSETUP.exe (PID: 2148)

Adds / modifies Windows certificates

BlackSun.exe (PID: 2124)

INFO

Checks supported languages

chrome.exe (PID: 2712)
chrome.exe (PID: 3072)
chrome.exe (PID: 648)
chrome.exe (PID: 2348)
chrome.exe (PID: 3728)
chrome.exe (PID: 2800)
chrome.exe (PID: 3792)
chrome.exe (PID: 2356)
chrome.exe (PID: 1316)
chrome.exe (PID: 3700)
chrome.exe (PID: 1436)
chrome.exe (PID: 2604)
chrome.exe (PID: 2816)
chrome.exe (PID: 2864)
chrome.exe (PID: 356)
chrome.exe (PID: 2488)
chrome.exe (PID: 2476)
chrome.exe (PID: 3104)
chrome.exe (PID: 3164)
chrome.exe (PID: 2892)
chrome.exe (PID: 3808)
chrome.exe (PID: 296)
chrome.exe (PID: 2440)
chrome.exe (PID: 328)
chrome.exe (PID: 552)
chrome.exe (PID: 2348)
chrome.exe (PID: 1792)
chrome.exe (PID: 3108)
chrome.exe (PID: 3184)
chrome.exe (PID: 2144)
chrome.exe (PID: 2188)
chrome.exe (PID: 388)
taskmgr.exe (PID: 2336)
chrome.exe (PID: 2688)
DllHost.exe (PID: 2652)
vssvc.exe (PID: 1256)
DllHost.exe (PID: 1460)
netsh.exe (PID: 1804)
route.exe (PID: 2756)
route.exe (PID: 1124)
netsh.exe (PID: 2028)
netsh.exe (PID: 2360)
netsh.exe (PID: 2284)
route.exe (PID: 348)
route.exe (PID: 2644)
route.exe (PID: 1524)
netsh.exe (PID: 2532)
taskmgr.exe (PID: 1988)
netsh.exe (PID: 2692)
route.exe (PID: 3748)
route.exe (PID: 2848)
netsh.exe (PID: 3300)
route.exe (PID: 2568)
netsh.exe (PID: 3352)
netsh.exe (PID: 120)
route.exe (PID: 2940)
netsh.exe (PID: 624)
route.exe (PID: 2864)

Reads the computer name

chrome.exe (PID: 2712)
chrome.exe (PID: 3072)
chrome.exe (PID: 3164)
chrome.exe (PID: 3700)
chrome.exe (PID: 3728)
chrome.exe (PID: 552)
chrome.exe (PID: 2440)
chrome.exe (PID: 1792)
chrome.exe (PID: 3184)
chrome.exe (PID: 2188)
taskmgr.exe (PID: 2336)
chrome.exe (PID: 2688)
DllHost.exe (PID: 2652)
vssvc.exe (PID: 1256)
DllHost.exe (PID: 1460)
netsh.exe (PID: 2360)
netsh.exe (PID: 2028)
netsh.exe (PID: 2284)
netsh.exe (PID: 2532)
taskmgr.exe (PID: 1988)
netsh.exe (PID: 2692)
netsh.exe (PID: 3300)
netsh.exe (PID: 120)
netsh.exe (PID: 3352)
netsh.exe (PID: 624)
netsh.exe (PID: 1804)

Application launched itself

chrome.exe (PID: 2712)

Reads settings of System Certificates

chrome.exe (PID: 3164)
chrome.exe (PID: 2712)
DXSETUP.exe (PID: 2148)
BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Manual execution by user

chrome.exe (PID: 2712)
taskmgr.exe (PID: 2336)
directx_Jun2010_redist.exe (PID: 752)
DXSETUP.exe (PID: 3540)
DXSETUP.exe (PID: 2148)
BlackSun.exe (PID: 2468)
BlackSun.exe (PID: 2124)
taskmgr.exe (PID: 1988)
BlackSun.exe (PID: 3480)
BlackSun.exe (PID: 2540)

Reads the hosts file

chrome.exe (PID: 3164)
chrome.exe (PID: 2712)
BlackSun.exe (PID: 2124)
BlackSun.exe (PID: 3480)

Reads the date of Windows installation

chrome.exe (PID: 552)

Checks Windows Trust Settings

chrome.exe (PID: 2712)
DXSETUP.exe (PID: 2148)

Threats

No threats detected