Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
09-09-2023 12:39
General
-
Target
00ee54378e6756b246a4c783d17f04a8c80782cba56b3721e9806173bb14cbedexe_JC.exe
-
Size
4.4MB
-
MD5
ced6b4527a3f34f3c41f64326e5ed855
-
SHA1
fbc58ca9210f0cae4271ef28d14f66dadf073bf8
-
SHA256
00ee54378e6756b246a4c783d17f04a8c80782cba56b3721e9806173bb14cbed
-
SHA512
8189a8fcfda20a5195a75b4f6ea9ffcb92f7b7e6198c738f3a4d5908d5470d69d15f77919da13705b03b473b182c7d20db68861254046827ca88f00b2f7e3005
-
SSDEEP
98304:JpboyaGFmzStgEVRi4fEkZdulDMeF6UugCwrzE/2SMb/4K:JpoypFmzenHzfEGU6/dE4
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ee54378e6756b246a4c783d17f04a8c80782cba56b3721e9806173bb14cbedexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\00ee54378e6756b246a4c783d17f04a8c80782cba56b3721e9806173bb14cbedexe_JC.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 13522⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
816KB
-
Filesize
296KB
-
Filesize
4.5MB
-
Filesize
36KB
-
Filesize
6.9MB
-
Filesize
4.5MB
-
Filesize
512KB
-
Filesize
4.5MB
-
Filesize
44KB
-
Filesize
256KB
-
Filesize
92KB
-
Filesize
960KB
-
Filesize
296KB
-
Filesize
6.9MB
-
Filesize
524KB
-
Filesize
56KB
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
60KB
-
Filesize
512KB
-
Filesize
328KB
-
Filesize
52KB
-
Filesize
352KB
-
Filesize
256KB
-
Filesize
156KB
-
Filesize
92KB
-
Filesize
40KB
-
Filesize
60KB
-
Filesize
328KB
-
Filesize
52KB
-
Filesize
352KB