Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\blitz\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\Blitz\Blitz.exe" "%1"'
Malicious functions
Injects code into
the following user processes:
- blitz.exe
Modifies file system
Creates the following files
- %TEMP%\nsq7a1f.tmp\system.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\safe_x64_injector.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\pinmanager.exe
- %LOCALAPPDATA%\programs\blitz\resources\binaries\native-utils.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\lor-overlay.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\fortnite-internal.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\blitz-overlay.dll
- %LOCALAPPDATA%\programs\blitz\libglesv2.dll
- %LOCALAPPDATA%\programs\blitz\libegl.dll
- %LOCALAPPDATA%\programs\blitz\ffmpeg.dll
- %LOCALAPPDATA%\programs\blitz\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\blitz\blitz.exe
- %LOCALAPPDATA%\programs\blitz\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\blitz\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\blitz\snapshot_blob.bin
- %LOCALAPPDATA%\programs\blitz\resources\binaries\safe_x86_injector.exe
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.js.gz
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.html
- %LOCALAPPDATA%\programs\blitz\resources\binaries\index.node
- %LOCALAPPDATA%\programs\blitz\resources\binaries\electron_overlay.node
- %LOCALAPPDATA%\programs\blitz\resources\binaries\blitz_core.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-x64\node.napi.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\win32-ia32\node.napi.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-x64\node.napi.musl.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-x64\node.napi.glibc.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm64\node.napi.armv8.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm\node.napi.armv7.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\linux-arm\node.napi.armv6.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\darwin-x64\node.napi.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\android-arm64\node.napi.armv8.node
- %LOCALAPPDATA%\programs\blitz\resources\app.asar.unpacked\node_modules\leveldown\prebuilds\android-arm\node.napi.armv7.node
- %LOCALAPPDATA%\programs\blitz\resources\overlay\index.js
- %APPDATA%\blitz\blitz-deps\1.15.51\native-utils.dll
- %APPDATA%\blitz\gpucache\data_2
- %LOCALAPPDATA%\programs\blitz\swiftshader\libegl.dll
- %APPDATA%\blitz\gpucache\data_1
- %APPDATA%\blitz\gpucache\data_0
- %APPDATA%\blitz\gpucache\index
- %APPDATA%\blitz\cache\data_3
- %APPDATA%\blitz\cache\data_2
- %APPDATA%\blitz\cache\data_1
- %APPDATA%\blitz\cache\data_0
- %APPDATA%\blitz\cache\index
- %APPDATA%\blitz\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\blitz\app.log
- %APPDATA%\blitz\crashpad\settings.dat
- %APPDATA%\blitz\blitz-deps\1.15.51\valorant-internal.dll
- %APPDATA%\blitz\blitz-deps\1.15.51\safe_x86_injector.exe
- %APPDATA%\blitz\blitz-deps\1.15.51\safe_x64_injector.exe
- %LOCALAPPDATA%\programs\blitz\resources\app.asar
- %APPDATA%\blitz\blitz-deps\1.15.51\pinmanager.exe
- %APPDATA%\blitz\blitz-deps\1.15.51\lor-overlay.dll
- %APPDATA%\blitz\blitz-deps\1.15.51\index.node
- %APPDATA%\blitz\blitz-deps\1.15.51\fortnite-internal.dll
- %APPDATA%\blitz\blitz-deps\1.15.51\electron_overlay.node
- %APPDATA%\blitz\blitz-deps\1.15.51\blitz_core.node
- %APPDATA%\blitz\blitz-deps\1.15.51\blitz-overlay.dll
- %HOMEPATH%\desktop\blitz.lnk
- %TEMP%\nsq7a1f.tmp\winshell.dll
- %APPDATA%\microsoft\windows\start menu\programs\blitz.lnk
- %LOCALAPPDATA%\programs\blitz\uninstall blitz.exe
- %LOCALAPPDATA%\blitz-updater\installer.exe
- %LOCALAPPDATA%\programs\blitz\vulkan-1.dll
- %LOCALAPPDATA%\programs\blitz\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\blitz\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\blitz\resources\binaries\valorant-internal.dll
- %LOCALAPPDATA%\programs\blitz\resources\elevate.exe
- %LOCALAPPDATA%\programs\blitz\resources\app-update.yml
- %LOCALAPPDATA%\programs\blitz\locales\hr.pak
- %LOCALAPPDATA%\programs\blitz\locales\gu.pak
- %LOCALAPPDATA%\programs\blitz\locales\fr.pak
- %LOCALAPPDATA%\programs\blitz\locales\fil.pak
- %LOCALAPPDATA%\programs\blitz\locales\fi.pak
- %LOCALAPPDATA%\programs\blitz\locales\fa.pak
- %LOCALAPPDATA%\programs\blitz\locales\et.pak
- %LOCALAPPDATA%\programs\blitz\locales\es.pak
- %LOCALAPPDATA%\programs\blitz\locales\es-419.pak
- %LOCALAPPDATA%\programs\blitz\locales\en-us.pak
- %LOCALAPPDATA%\programs\blitz\locales\en-gb.pak
- %LOCALAPPDATA%\programs\blitz\locales\el.pak
- %LOCALAPPDATA%\programs\blitz\locales\de.pak
- %LOCALAPPDATA%\programs\blitz\locales\da.pak
- %LOCALAPPDATA%\programs\blitz\locales\cs.pak
- %LOCALAPPDATA%\programs\blitz\locales\he.pak
- %LOCALAPPDATA%\programs\blitz\locales\ca.pak
- %LOCALAPPDATA%\programs\blitz\locales\bg.pak
- %LOCALAPPDATA%\programs\blitz\locales\ar.pak
- %LOCALAPPDATA%\programs\blitz\locales\am.pak
- %LOCALAPPDATA%\programs\blitz\licenses.chromium.html
- %LOCALAPPDATA%\programs\blitz\license.electron.txt
- %LOCALAPPDATA%\programs\blitz\icudtl.dat
- %LOCALAPPDATA%\programs\blitz\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\blitz\chrome_100_percent.pak
- %TEMP%\nsq7a1f.tmp\nsis7z.dll
- %TEMP%\nsq7a1f.tmp\app-32.7z
- %TEMP%\nsq7a1f.tmp\spiderbanner.dll
- %TEMP%\nsq7a1f.tmp\nsexec.dll
- %TEMP%\nsq7a1f.tmp\nsprocess.dll
- %TEMP%\nsq7a1f.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\blitz\locales\bn.pak
- %LOCALAPPDATA%\programs\blitz\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\blitz\resources.pak
- %LOCALAPPDATA%\programs\blitz\locales\hu.pak
- %LOCALAPPDATA%\programs\blitz\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\blitz\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\blitz\locales\vi.pak
- %LOCALAPPDATA%\programs\blitz\locales\uk.pak
- %LOCALAPPDATA%\programs\blitz\locales\tr.pak
- %LOCALAPPDATA%\programs\blitz\locales\th.pak
- %LOCALAPPDATA%\programs\blitz\locales\te.pak
- %LOCALAPPDATA%\programs\blitz\locales\ta.pak
- %LOCALAPPDATA%\programs\blitz\locales\sw.pak
- %LOCALAPPDATA%\programs\blitz\locales\sv.pak
- %LOCALAPPDATA%\programs\blitz\locales\sr.pak
- %LOCALAPPDATA%\programs\blitz\locales\sl.pak
- %LOCALAPPDATA%\programs\blitz\locales\sk.pak
- %LOCALAPPDATA%\programs\blitz\locales\ru.pak
- %LOCALAPPDATA%\programs\blitz\resources\.env.production
- %LOCALAPPDATA%\programs\blitz\locales\ro.pak
- %LOCALAPPDATA%\programs\blitz\locales\pt-br.pak
- %LOCALAPPDATA%\programs\blitz\locales\pl.pak
- %LOCALAPPDATA%\programs\blitz\locales\nl.pak
- %LOCALAPPDATA%\programs\blitz\locales\nb.pak
- %LOCALAPPDATA%\programs\blitz\locales\ms.pak
- %LOCALAPPDATA%\programs\blitz\locales\mr.pak
- %LOCALAPPDATA%\programs\blitz\locales\ml.pak
- %LOCALAPPDATA%\programs\blitz\locales\lv.pak
- %LOCALAPPDATA%\programs\blitz\locales\lt.pak
- %LOCALAPPDATA%\programs\blitz\locales\ko.pak
- %LOCALAPPDATA%\programs\blitz\locales\kn.pak
- %LOCALAPPDATA%\programs\blitz\locales\ja.pak
- %LOCALAPPDATA%\programs\blitz\locales\it.pak
- %LOCALAPPDATA%\programs\blitz\locales\id.pak
- %LOCALAPPDATA%\programs\blitz\locales\hi.pak
- %APPDATA%\blitz\gpucache\data_3
Deletes the following files
- %TEMP%\nsq7a1f.tmp\app-32.7z
- %TEMP%\nsq7a1f.tmp\nsexec.dll
- %TEMP%\nsq7a1f.tmp\nsis7z.dll
- %TEMP%\nsq7a1f.tmp\nsprocess.dll
- %TEMP%\nsq7a1f.tmp\spiderbanner.dll
- %TEMP%\nsq7a1f.tmp\stdutils.dll
- %TEMP%\nsq7a1f.tmp\system.dll
- %TEMP%\nsq7a1f.tmp\winshell.dll
Network activity
Connects to
- 'ut###.iesdev.com':443
TCP
Other
- 'ut###.iesdev.com':443
UDP
- DNS ASK ut###.iesdev.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Blitz'
Creates and executes the following
- '%LOCALAPPDATA%\programs\blitz\blitz.exe'
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=crashpad-handler --user-data-dir=%APPDATA%\Blitz /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\Blitz\Crashpad --url=https://sentry.bli...
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=gpu-process --field-trial-handle=1296,8384702209006169437,7309475050795889032,131072 --disable-features=HardwareMediaKeyHandling,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnly...
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1296,8384702209006169437,7309475050795889032,131072 --disable-features=HardwareMediaKeyHandling,SpareRenderer...
- '%LOCALAPPDATA%\programs\blitz\blitz.exe' --type=renderer --user-data-dir="%APPDATA%\Blitz" --enable-sandbox --app-user-model-id=com.blitz.app --app-path="%LOCALAPPDATA%\Programs\Blitz\resources\app.asar" --enable-sandbox --disable-bli...
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "chcp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path win32_VideoController get /value"' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path win32_desktopmonitor get /value"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe cpu get /value"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "chcp"
- '%WINDIR%\syswow64\wbem\wmic.exe' path Win32_CacheMemory get CacheType,InstalledSize,Purpose
- '%WINDIR%\syswow64\wbem\wmic.exe' cpu get /value
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path Win32_CacheMemory get CacheType,InstalledSize,Purpose"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe cpu get /value"
- '%WINDIR%\syswow64\reg.exe' query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet
- '%WINDIR%\syswow64\wbem\wmic.exe' os get /value
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_desktopmonitor get /value
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""
- '%WINDIR%\syswow64\wbem\wmic.exe' path win32_VideoController get /value
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "reg query "HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0" /v FeatureSet"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe os get /value"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path win32_desktopmonitor get /value"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "<SYSTEM32>\chcp.com 65001 | <SYSTEM32>\wbem\wmic.exe path win32_VideoController get /value"
- '%WINDIR%\syswow64\cmd.exe' /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"
- '%WINDIR%\syswow64\chcp.com'
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\findstr.exe' /C:"Detected boot environment" "%WINDIR%\Panther\setupact.log"
