Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
launcher-1.09_16.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
launcher-1.09_16.exe
Resource
win10v2004-20240221-en
General
-
Target
launcher-1.09_16.exe
-
Size
711KB
-
MD5
7604d8a9b4c4b9ca9e25216f9b4ab99f
-
SHA1
309e1722bfb7812e4d19d4e06db97a6ecd8cb30c
-
SHA256
d1843a3d0326fd5e516bab8171e756ef417e6f740faf3003db8178516bc60b89
-
SHA512
7e9d7fdab97ffe0f7fde949ea5d8355d0efc89b8769102e55425958491978a438c82cf944255be6f70103c7a2b0d4c115bb9b9e5f0dec95c0b4c84dcf4fbdc93
-
SSDEEP
12288:Eh1gvaO9uz48+RTw4uI8w90bYKaLRmRcW83YQFXrLia73lnxHAedbcZzC:Eh1gvaQuk8cU4unwQaXW0YQ9rn3lnVd1
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3600 icacls.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb javaw.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 884 taskmgr.exe Token: SeSystemProfilePrivilege 884 taskmgr.exe Token: SeCreateGlobalPrivilege 884 taskmgr.exe Token: 33 884 taskmgr.exe Token: SeIncBasePriorityPrivilege 884 taskmgr.exe -
Suspicious use of FindShellTrayWindow 61 IoCs
pid Process 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe 884 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1224 javaw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1224 5064 launcher-1.09_16.exe 87 PID 5064 wrote to memory of 1224 5064 launcher-1.09_16.exe 87 PID 1224 wrote to memory of 3600 1224 javaw.exe 90 PID 1224 wrote to memory of 3600 1224 javaw.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe"C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\launcher-1.09_16.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M3⤵
- Modifies file permissions
PID:3600
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5c9fe002e66876f05f22d6a197ca5beca
SHA17123c12d548c286a90ba6c431cc0a3e206d4d5cb
SHA2565a4bc7f28b7581559a6caf47988ddb47235671f52aa10ddbd11e5f72b8f5fb5c
SHA5125c19f8702b6cdfa5c022666e190b1e01d380e4a0a5e7bc3df97f5850b6501e45c35c4e0e6bd49390b917c3f9678a8ddaf1afe7e5fb036deedb7350eefa922f1f