Analysis

  • max time kernel
    122s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 00:25

General

  • Target

    GlobalProtect64/GlobalProtect64.exe

  • Size

    359KB

  • MD5

    0ff2ca0c7b5c6e167d52cba95f00eec9

  • SHA1

    bfaa5eea2b921b7a0b801bda00f69196c213b880

  • SHA256

    bd8016b895b404f43e1d6614b564927385d74534cef319c0ea5236dd9ed00b2f

  • SHA512

    1630b14ba53d96369002d78e9f390119781203049a19d7d3e8002bb0103c1b91c746b73b80f9d7ffd1ec7c6caf66eb8f5c2df2d2d801c953941db3be0330273e

  • SSDEEP

    6144:J12UdfHkDSdefEvAxa1snobprfkj3d5Qz1zAyN0Pf2+kqE:T24V4Va2noNE3UzfQkqE

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\GlobalProtect64.exe
    "C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\GlobalProtect64.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:2148
    • \??\c:\users\admin\appdata\local\temp\GLOBAL~1\jre\bin\java.exe
      c:\users\admin\appdata\local\temp\GLOBAL~1\jre\bin\java.exe -version
      2⤵
      • Checks processor information in registry
      PID:2920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2148-27-0x0000000007A70000-0x0000000008A70000-memory.dmp

    Filesize

    16.0MB

  • memory/2148-34-0x000000005C340000-0x000000006229F000-memory.dmp

    Filesize

    95.4MB

  • memory/2920-10-0x000000000C640000-0x000000000D640000-memory.dmp

    Filesize

    16.0MB

  • memory/2920-15-0x000000000CBD0000-0x000000000CE40000-memory.dmp

    Filesize

    2.4MB

  • memory/2920-19-0x000000000C640000-0x000000000D640000-memory.dmp

    Filesize

    16.0MB

  • memory/2920-35-0x000000000C640000-0x000000000D640000-memory.dmp

    Filesize

    16.0MB