File name: | Blackbird_v1.0.79.3_x32.zip |
Full analysis: | https://app.any.run/tasks/51e2b9fa-f889-4816-a90e-631d480dd9bd |
Verdict: | Malicious activity |
Analysis date: | January 17, 2020, 18:43:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 9E9C3BC9415D19D5B361670017E82C75 |
SHA1: | DD94316A765D4C18B263D2031BC8BB45BE96EBC2 |
SHA256: | D66D16E341F3E6E3C9CAF0D32E4080C76315EF50DFBB2576AEF3C5E274F27B3C |
SSDEEP: | 12288:U1r0G8ZAsYA4PSK3aKG4D0WrI3GDAb3cEhQSTocUxT4EMZitW:k0/AJ7PSKKKFD0bp5hQSRmM |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | blackbird_v1.0.79.3_32/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2019:11:01 21:35:08 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
1412 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Blackbird_v1.0.79.3_x32.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 | ||||
4016 | "C:\Users\admin\Desktop\blackbird_v1.0.79.3_32\blackbird.exe" | C:\Users\admin\Desktop\blackbird_v1.0.79.3_32\blackbird.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Exit code: 3221226540 | ||||
1944 | "C:\Users\admin\Desktop\blackbird_v1.0.79.3_32\blackbird.exe" | C:\Users\admin\Desktop\blackbird_v1.0.79.3_32\blackbird.exe | explorer.exe | |
User: admin Integrity Level: HIGH | ||||
3424 | "C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\1BA1.tmp\1BA2.tmp\1BA3.bat C:\Users\admin\Desktop\blackbird_v1.0.79.3_32\blackbird.exe" | C:\Windows\system32\cmd.exe | — | blackbird.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3876 | chcp 437 | C:\Windows\system32\chcp.com | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1752 | fltmc | C:\Windows\system32\fltMC.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Filter Manager Control Program Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3304 | shutdown /a | C:\Windows\system32\shutdown.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Shutdown and Annotation Tool Exit code: 1116 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1296 | C:\Windows\system32\cmd.exe /c ver | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
624 | C:\Windows\system32\cmd.exe /c wmic /node:"USER-PC" COMPUTERSYSTEM GET USERNAME | findstr /i "USER-PC" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3672 | wmic /node:"USER-PC" COMPUTERSYSTEM GET USERNAME | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
Operation: | write | Name: | @C:\Windows\system32\NetworkExplorer.dll,-1 |
Value: Network | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\Blackbird_v1.0.79.3_x32.zip | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (1412) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin |
Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1412 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1412.14329\blackbird_v1.0.79.3_32\blackbird.exe | — | |
MD5:— | SHA256:— | |||
1412 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa1412.14329\blackbird_v1.0.79.3_32\README.txt | — | |
MD5:— | SHA256:— | |||
2128 | findstr.exe | C:\Users\admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp | text | |
MD5:B57796E75D6B78D63CF49396B0143EAE | SHA256:606C2924DD3C4FE0E5DED7F8FBC65952B0C4E88F0ED8B13A9317DF1E5DB522EE | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\blackbirds_temp\bird.qfe.tmp | text | |
MD5:B49D972ACF69EA18BCB132F97892B067 | SHA256:045A2276FBEDC29D5EAA4A5BF988A34261D46C9BBE10D73BC222CEBA41055253 | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\blackbird-gui.tmp | text | |
MD5:A81CCED386011E782B43C0D3251B560B | SHA256:AA03808FA7D3D597C9532B62AC48A55E5796CC947FEDC98BECB5E41F15F8E2E9 | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\blackbirds_temp\bird.ncfg.tmp | text | |
MD5:3ABA2A1D2E367AE79E6F4698CD3C7F49 | SHA256:E3FF9CD1DC7258171E5FA6ACEEBCC823A820C1337FE8753499E3F2B31199E8BD | |||
1944 | blackbird.exe | C:\Users\admin\AppData\Local\Temp\1BA1.tmp\1BA2.tmp\1BA3.bat | text | |
MD5:54170A89A9B7454514EA2D1B754C50A3 | SHA256:42C9DD8A0F0572B36F3CEE0B6A96B37B01F68F4341CA1C780149800443A8DAB7 | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\blackbirds_temp\blackbird.tempsch_raw.tmp | text | |
MD5:B57796E75D6B78D63CF49396B0143EAE | SHA256:606C2924DD3C4FE0E5DED7F8FBC65952B0C4E88F0ED8B13A9317DF1E5DB522EE | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\blackbirds_temp\brd_rini.tmp | text | |
MD5:91F310BCD906AAA899F28FC9D7C88A89 | SHA256:80D66E13779867EC91D0CFA27BCFF78C024FD9F66BE58FC510DCE90B5AA1A0BC | |||
3424 | cmd.exe | C:\Users\admin\AppData\Local\Temp\' | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8 |
Domain | IP | Reputation |
---|---|---|
2.100.168.192.in-addr.arpa |
| whitelisted |
google.com |
| whitelisted |
112.2o7.net |
| suspicious |
6to4.ipv6.microsoft.com |
| whitelisted |
a-0001.a-msedge.net |
| whitelisted |
a-0002.a-msedge.net |
| unknown |
a-0003.a-msedge.net |
| whitelisted |
a-0004.a-msedge.net |
| unknown |
a-0005.a-msedge.net |
| unknown |
a-0006.a-msedge.net |
| whitelisted |