Analysis

  • max time kernel
    303s
  • max time network
    295s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2023, 17:07

General

  • Target

    Java(TM) Platform SE 8.exe

  • Size

    131.9MB

  • MD5

    dd786a113a824d80c4929a61167735b0

  • SHA1

    1ce96282cc1c383488ab752f086005c67bd54260

  • SHA256

    a73e258a67723d40d2b637d26f1f38a130b9a95c9f5df38ca718e5927f8bd9f4

  • SHA512

    be1e52834946c03697b3a995d237bb7f8018c0fc075338be11b63815cdc204ccaa5363446aa1d0f2a95e94f4f23895f47f6f49d1cecfee28c3e2d347c08d1cfa

  • SSDEEP

    1572864:+4sMLl/BkZTVV2iplzf+ekzrMdTOG0AfhgojwlwVgmPQtn06H9rejAEdCoIZXCVJ:3l/BkVVPBDgmPKa5Wnu3X7

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE 8.exe
    "C:\Users\Admin\AppData\Local\Temp\Java(TM) Platform SE 8.exe"
    1⤵
      PID:3384
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2136

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2136-133-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-134-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-135-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-139-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-140-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-142-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-141-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-144-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-143-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB

          • memory/2136-145-0x000001D6D7F10000-0x000001D6D7F11000-memory.dmp

            Filesize

            4KB