40ba07f9761a6565642d7aae57f2f4622030e33fe80eb46a543446dcb8e3f1ca | Triage

Analysis

max time kernel
125s
max time network
18s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 09:49

Sharing

Report Analysis Logs

General

Target

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
Size

3.5MB
MD5

7ec07e27817c7dc87b3cf22533509581
SHA1

b3cd8a2386897d53133b8a6193989f2a6324a71f
SHA256

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f
SHA512

aed38074b14d441566677af3cada2b695f2ffca9651e79f3df0ccad9daac8c69d03cca016a4bd36a9fc3e798debe4a39cb60d00ef566c02c25813c35d6ccf36f

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

javaw.exe

pid process

1612 javaw.exe
1612 javaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe

description	pid	process	target process
PID 1684 wrote to memory of 1612	1684	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe
PID 1684 wrote to memory of 1612	1684	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe
PID 1684 wrote to memory of 1612	1684	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe
PID 1684 wrote to memory of 1612	1684	437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe	javaw.exe

C:\Users\Admin\AppData\Local\Temp\437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe
"C:\Users\Admin\AppData\Local\Temp\437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\437d91ce52c0b54e125d28ea1bc6b5547183f04e40f9e487150be7862e61688f.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1612

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-3-0x0000000000000000-mapping.dmp

Download
memory/1612-4-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1612-5-0x00000000020A0000-0x0000000002310000-memory.dmp

Filesize
2.4MB

Download
memory/1684-2-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download