202fd829411462e1ded639a9b31ba891b9edeb9e2fb05b62ed00b2dbb3dcf6a5

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2023, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Task Till Dawn.exe
Size

5.1MB
MD5

d269bb7d71629110b5d6cd06f7b1d703
SHA1

50fa3fca4996e86665dbf8f762ad0a0b944bcd31
SHA256

2ec950195227163b78a2dddbb3341fa7055c4bbd482a47a15ef7ba324177818e
SHA512

17a8d17b35b00746ce35a16d72aa1c4bbf191c6c965cbb726d17d8c5c1a204a32f7e731b92c1b437d937ff208ffc5668ade71018904e23be9128c7c73d50beb6
SSDEEP

98304:w+kAlLSkFcvAAVVvQPANfKwVJIjJgFtxh0ppPCDIUQKPQtSdlmNJUQLZf2:/PjFcvf5QPAseJCJqrWppiIZ/NJLQ

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1300	javaw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	javaw.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1300	javaw.exe
1300	javaw.exe
1300	javaw.exe
1300	javaw.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1300	1424	Task Till Dawn.exe	83
PID 1424 wrote to memory of 1300	1424	Task Till Dawn.exe	83

C:\Users\Admin\AppData\Local\Temp\Task Till Dawn.exe
"C:\Users\Admin\AppData\Local\Temp\Task Till Dawn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -Dlaunch4j.exedir="C:\Users\Admin\AppData\Local\Temp" -Dlaunch4j.exefile="C:\Users\Admin\AppData\Local\Temp\Task Till Dawn.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Task Till Dawn.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4333692016710807544.dll

Filesize
240KB

MD5
1164914ca1307de98cc0d57e42285ef2

SHA1
9387f983c88c425c91e5caae2409cf4180b02096

SHA256
0525f9e2db0146f7abcc8cd86cf4fb01721fad0d5c9a1806b5805bb789eb8c98

SHA512
7fbb98c3768e22429ad39070fd2fdbf38d9585e81df592d7fb64cdc03e890d6ce57a72bafbc8815ace9076e5241cfb77d8c23ff1db66ba7564131506d487dc5e

Download Submit
memory/1300-190-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-215-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-160-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-162-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-172-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-143-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-199-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-236-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-222-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-223-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-224-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-233-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1300-235-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/1424-156-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads