Resubmissions
12-02-2024 17:24
240212-vy4t1scb63 412-02-2024 17:21
240212-vw6ktscb44 712-02-2024 17:20
240212-vwegcaae2x 7Analysis
-
max time kernel
1799s -
max time network
1173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BSLauncher.exe
Resource
win7-20231129-en
windows7-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
BSLauncher.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
11 signatures
1800 seconds
General
-
Target
BSLauncher.exe
-
Size
672KB
-
MD5
af692c7b9a7c0474f32aae9fbb6e0d5c
-
SHA1
b2a34238258b8c38134737bfd0ab81b69641fe91
-
SHA256
ab1fe3304dcdc8a5ca246c321ad80d0432ce182ad068701345c01b97eb7b0933
-
SHA512
1be8d08605446a6e6823c6e8b35c740091e77e3acdf3551adf2fe8d00c9997c028c0d01f927db7c9f5a3ae94a3f27806ef755308306cb5140c34ef328ed07178
-
SSDEEP
12288:TSKyBFTk40TSeylSfylxqu2uTjGeKQR+l9zCp0D4wMMKz6:THmFTR0meylS6lYuNxKQQlRQyN
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1116 icacls.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb javaw.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4256 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4256 taskmgr.exe Token: SeSystemProfilePrivilege 4256 taskmgr.exe Token: SeCreateGlobalPrivilege 4256 taskmgr.exe Token: SeManageVolumePrivilege 2860 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe 4256 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4384 javaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4280 wrote to memory of 4384 4280 BSLauncher.exe 83 PID 4280 wrote to memory of 4384 4280 BSLauncher.exe 83 PID 4384 wrote to memory of 1116 4384 javaw.exe 85 PID 4384 wrote to memory of 1116 4384 javaw.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\BSLauncher.exe"C:\Users\Admin\AppData\Local\Temp\BSLauncher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\BSLauncher.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:1116
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4256
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD54dae5ba81066565ea6452d1fb2a084db
SHA1265013cc35cdbe843eacb99cb355b4866e7ed977
SHA2567c0a3b9fa12c8b1e22e73f1440126afe5f5754a17f8b998fb49788e26e96acff
SHA5128821e88cb610e902c964b7a63797f78d20ee8e756173df42b4a5b5cadce7cfe0bde394653689edc9fff882d2a47d135dbb0eeea3644bb46383e7d6fa4f1a2471