Overview
overview
10Static
static
3RainwaySetup.exe
windows7-x64
7RainwaySetup.exe
windows10-2004-x64
10$TEMP/Feel...o.jnlp
windows7-x64
1$TEMP/Feel...o.jnlp
windows10-2004-x64
7$TEMP/Feel...R.jnlp
windows7-x64
1$TEMP/Feel...R.jnlp
windows10-2004-x64
1$TEMP/Feel...v.jnlp
windows7-x64
1$TEMP/Feel...v.jnlp
windows10-2004-x64
1$TEMP/Feel...N.jnlp
windows7-x64
1$TEMP/Feel...N.jnlp
windows10-2004-x64
1$TEMP/Feel...K.jnlp
windows7-x64
1$TEMP/Feel...K.jnlp
windows10-2004-x64
1$TEMP/Feel...W.jnlp
windows7-x64
1$TEMP/Feel...W.jnlp
windows10-2004-x64
1$TEMP/Feel...32.jar
windows7-x64
1$TEMP/Feel...32.jar
windows10-2004-x64
7$TEMP/Feel...ge.jar
windows7-x64
1$TEMP/Feel...ge.jar
windows10-2004-x64
7$TEMP/Feel...ta.jar
windows7-x64
1$TEMP/Feel...ta.jar
windows10-2004-x64
7$TEMP/Feel...ns.jar
windows7-x64
1$TEMP/Feel...ns.jar
windows10-2004-x64
7$TEMP/Feel...ss.jar
windows7-x64
1$TEMP/Feel...ss.jar
windows10-2004-x64
7$TEMP/Feel...rt.jar
windows7-x64
1$TEMP/Feel...rt.jar
windows10-2004-x64
7$TEMP/Feel...ta.jar
windows7-x64
1$TEMP/Feel...ta.jar
windows10-2004-x64
7$TEMP/Feel...rn.jar
windows7-x64
1$TEMP/Feel...rn.jar
windows10-2004-x64
7$TEMP/Feel...ec.jar
windows7-x64
1$TEMP/Feel...ec.jar
windows10-2004-x64
7Analysis
- max time kernel
438s - max time network
448s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/03/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
RainwaySetup.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
RainwaySetup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_ko.jnlp
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_ko.jnlp
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_pt_BR.jnlp
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_pt_BR.jnlp
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_sv.jnlp
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_sv.jnlp
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_CN.jnlp
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral10
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_CN.jnlp
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_HK.jnlp
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_HK.jnlp
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_TW.jnlp
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_TW.jnlp
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge-32.jar
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge-32.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge.jar
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge.jar
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/cldrdata.jar
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/cldrdata.jar
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/dnsns.jar
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/dnsns.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/jaccess.jar
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/jaccess.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/jfxrt.jar
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral26
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/jfxrt.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/localedata.jar
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral28
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/localedata.jar
Resource
win10v2004-20240319-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/nashorn.jar
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/nashorn.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/sunec.jar
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral32
Sample
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/sunec.jar
Resource
win10v2004-20240226-en
windows10-2004-x64
General
- Target $TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_zh_HK.jnlp
- Size 3KB
- Sample240319-12pgdsha44
- SHA256 479dc754bd7bff2c9c35d2e308b138eef2a1a94cf4f0fc6ccd529df02c877dc7
- MD5 4287d97616f708e0a258be0141504beb
- SHA1 5d2110cabbbc0f83a89aec60a6b37f5f5ad3163e
- SHA512 f273f8d501c5d29422257733624b5193234635bd24b444874e38d8d823d728d935b176579d5d1203451c0ce377c57ed7eb3a9ce9adcb3bb591024c3b7ee78dcd
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4104 javaws.exe 4104 javaws.exe 4104 javaws.exe 4104 javaws.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4744 wrote to memory of 4104 4744 jp2launcher.exe 88 PID 4744 wrote to memory of 4104 4744 jp2launcher.exe 88
Processes
-
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_zh_HK.jnlp"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_zh_HK.jnlp"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4104
-