Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13-10-2023 23:22
General
-
Target
AYReport_EN.exe
-
Size
9.6MB
-
MD5
ec333982af0977d8af5a4984792a4385
-
SHA1
d5b7e49c6476766d45a18cdd150d0679a9529a5a
-
SHA256
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74
-
SHA512
1446ecc9ca6f193796cdbaf1b9f291b85a36279659254e6cbf286dba8a0e5f233c889b459b799a0d18462f1210841a61a207f76bc90db4365a43e7d967761cfc
-
SSDEEP
49152:LLLjKXCrX+hMesdq40bf95X9K5NRcSJDg/u/fiGhG6E7/6bp1pBt0zKkevwN/+j:
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AYReport_EN.exe"C:\Users\Admin\AppData\Local\Temp\AYReport_EN.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Adobe\PJ7QR0JJ.exe"C:\Users\Admin\AppData\Roaming\Adobe\PJ7QR0JJ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Low\PD18N92K.exe"C:\Users\Admin\AppData\Local\Temp\Low\PD18N92K.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5cdb983e76d6fc15c5eaef54a063f0091
SHA1ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA2560d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
SHA512a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
-
Filesize
1.8MB
MD5cdb983e76d6fc15c5eaef54a063f0091
SHA1ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA2560d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
SHA512a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
-
Filesize
1.8MB
MD5cdb983e76d6fc15c5eaef54a063f0091
SHA1ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA2560d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
SHA512a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
-
Filesize
1.8MB
MD58bbaf95337912b8a1d36594e5bb2f5e6
SHA15db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA256c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
SHA5123665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
-
Filesize
1.8MB
MD58bbaf95337912b8a1d36594e5bb2f5e6
SHA15db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA256c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
SHA5123665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
-
Filesize
1.8MB
MD58bbaf95337912b8a1d36594e5bb2f5e6
SHA15db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA256c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
SHA5123665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
-
Filesize
10.8MB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
9.6MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB