Resubmissions

29-10-2021 12:58

211029-p7t4aaaael 1

29-10-2021 12:10

211029-pb7z9saaak 1

Analysis

  • max time kernel
    27s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    29-10-2021 12:58

General

  • Target

    INV-7776-TCLTD.jar

  • Size

    495KB

  • MD5

    dd3331428fe8070e0cd89a20b1c4620f

  • SHA1

    68c1c50083d968c5b92937cf8a87bc1c1df69420

  • SHA256

    2c452e378b2ad8e0192bc804096eae9abc1e3fa3b9bd9cce4994217acfa239b9

  • SHA512

    e0521d421243ab84c2c42d93bd5f09d229c08d9d21c284267225327020bca9aa84019674f9f6b6aaca23ec451a427287c64c4cfea64f913f5c0c5da02edc7666

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\INV-7776-TCLTD.jar
    1⤵
      PID:268
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:968

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/268-54-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

      Filesize

      8KB

    • memory/268-55-0x00000000021B0000-0x0000000002420000-memory.dmp

      Filesize

      2.4MB

    • memory/268-56-0x00000000021B0000-0x0000000002420000-memory.dmp

      Filesize

      2.4MB

    • memory/268-57-0x0000000000120000-0x0000000000121000-memory.dmp

      Filesize

      4KB