55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
610s
max time network
620s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_ko.jnlp
Size 5KB
Sample240319-12pgdsha44
SHA256 292696c94d5fd0bf2ff4af9e4d363bfcbe888d2e65bd18a20cf71081fb1c9b0d
MD5 64de22212ee92f29bca3aced72737254
SHA1 c4dbc247043578ccf9cd8dab652d096703d5b26e
SHA512 ca33c75b66d8b5316b1c3ed41a9a14dd8611a3bb9b26efdc7f468250696d515cf1e966831975c9abdc33e9a1c59167fe79ba547592d2a04997e1342433e7b628
SSDEEP 96:GhymCk3kjLqgz9RkfrsEW/p9M32i0HkZr+ywc8b8+/moD7yct070DL70Dm:Dm5kLfIErMbT/44in
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1404	jp2launcher.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1404	jp2launcher.exe
1404	jp2launcher.exe
1404	jp2launcher.exe
1404	jp2launcher.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2332	2684	javaws.exe	29
PID 2684 wrote to memory of 2332	2684	javaws.exe	29
PID 2684 wrote to memory of 2332	2684	javaws.exe	29
PID 2684 wrote to memory of 1108	2684	javaws.exe	30
PID 2684 wrote to memory of 1108	2684	javaws.exe	30
PID 2684 wrote to memory of 1108	2684	javaws.exe	30
PID 2684 wrote to memory of 2328	2684	javaws.exe	31
PID 2684 wrote to memory of 2328	2684	javaws.exe	31
PID 2684 wrote to memory of 2328	2684	javaws.exe	31
PID 2684 wrote to memory of 1868	2684	javaws.exe	32
PID 2684 wrote to memory of 1868	2684	javaws.exe	32
PID 2684 wrote to memory of 1868	2684	javaws.exe	32
PID 2684 wrote to memory of 1404	2684	javaws.exe	33
PID 2684 wrote to memory of 1404	2684	javaws.exe	33
PID 2684 wrote to memory of 1404	2684	javaws.exe	33

C:\Program Files\Java\jre7\bin\javaws.exe
"C:\Program Files\Java\jre7\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_ko.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.10.80.2" "later"
  2⤵
  PID:2332
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.10.80.2" "1710886660"
  2⤵
  PID:1108
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre7\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.10.80.2" "false"
  2⤵
  PID:2328
- C:\Program Files\Java\jre7\bin\javaws.exe
  JavaWSSplashScreen -splash 49263 "C:\Program Files\Java\jre7\lib\deploy\splash.gif"
  2⤵
  PID:1868
- C:\Program Files\Java\jre7\bin\jp2launcher.exe
  "C:\Program Files\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXCRURU1QXEZlZWxpbmdFeWVzdHJhaW4tTGF1bmNoZXJcdTU3MVxsaWJcZGVwbG95XG1lc3NhZ2VzX2tvLmpubHAALURqbmxweC5yZW1vdmU9dHJ1ZQAtRHN1bi5hd3Qud2FybXVwPXRydWUALVhib290Y2xhc3NwYXRoL2E6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXGRlcGxveS5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXHBsdWdpbi5qYXIALURqbmxweC5zcGxhc2hwb3J0PTQ5MjY2AC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGJpblxqYXZhdy5leGU= -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGphdmF3czI=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 731B
SHA256 420ed909b92fb342f88e87083c178a98bb5be8b6858be9b5bc40017130a50779
MD5 bd43f3d64dd12d8c0ecea04858588743
SHA1 7567ea38f7cd6313a41cd64c63bc17725c1a692e
SHA512 c9fe3db6ecc02754e035791e0ce93aff191d44f53a58ad97cc5c9cadc18209f65cc42b38dede5e40f03da0fb29c8add3e18860c288e9959f5183bcaea6fd6893
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 792B
SHA256 83da6c182ce4213fded2a7f1a06102d7bc4da99404df93e4223dc6dca28902d3
MD5 bbb8e421bdbc2b975e3a18524abb495a
SHA1 5f711ba4ff3ec7b07cebd2431b172ea0dd16569a
SHA512 aa268430ae937ad771818b1c546eed15f159e4a42cf969fb8b5b6010842c359221f84c8cddb9337a42d9d129fca9e3995382987d7b87a9e6856ff0548f40eef2
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 850B
SHA256 cf7457e548f4991ecccf81eab51f61225f22c2bb401914104d0fb2bb7118d424
MD5 09c1aa7526a50c8fc59d627319bee287
SHA1 846c980ed0ddbe45b8ff7fbfd3bdaf3c7ab71f68
SHA512 befa02e96043b7bd3fdec5e5fc36b6c63c0c8d4779c4d6909a5b1c6f146f6894225b762d8874490c7da2025d82f64890e877b0253b0028bccdc95fc0c04c3501
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 850B
SHA256 1689a645e2acf83fe61613f5b2db8dbe27acb007534ff7d97cb2ea443f25a5b9
MD5 dab247b97559ccce38d5318a8a3a09e9
SHA1 a74028f12b5f6670c39d44111b7a7a1d51db962d
SHA512 55bc7f57272569a70c3533daff06ccf5524f1e84a17e0b13539d74d6377e693e2df15edbbddc8d3c844e243625e9228196d4766d5feba005b99b489a0e7e217c
MD5 SHA1 SHA512

Submit Download

javaws2

Path C:\Users\Admin\AppData\Local\Temp\javaws2
Size 5KB
SHA256 292696c94d5fd0bf2ff4af9e4d363bfcbe888d2e65bd18a20cf71081fb1c9b0d
MD5 64de22212ee92f29bca3aced72737254
SHA1 c4dbc247043578ccf9cd8dab652d096703d5b26e
SHA512 ca33c75b66d8b5316b1c3ed41a9a14dd8611a3bb9b26efdc7f468250696d515cf1e966831975c9abdc33e9a1c59167fe79ba547592d2a04997e1342433e7b628
SSDEEP 96:GhymCk3kjLqgz9RkfrsEW/p9M32i0HkZr+ywc8b8+/moD7yct070DL70Dm:Dm5kLfIErMbT/44in
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-182-0x0000000002150000-0x0000000005150000-memory.dmp

Download

memory/1108-29-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1108-40-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1108-41-0x0000000002150000-0x0000000005150000-memory.dmp

Download

memory/1404-140-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-126-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-357-0x0000000000750000-0x000000000075A000-memory.dmp

Download

memory/1404-65-0x0000000000750000-0x000000000075A000-memory.dmp

Download

memory/1404-67-0x0000000000750000-0x000000000075A000-memory.dmp

Download

memory/1404-74-0x0000000002510000-0x0000000005510000-memory.dmp

Download

memory/1404-212-0x0000000002510000-0x0000000005510000-memory.dmp

Download

memory/1404-95-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-98-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-102-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-108-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-109-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-115-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-117-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-118-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-199-0x0000000000750000-0x000000000075A000-memory.dmp

Download

memory/1404-120-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-195-0x0000000000750000-0x000000000075A000-memory.dmp

Download

memory/1404-133-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-138-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-137-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-171-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-158-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-166-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-167-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/1404-170-0x0000000000420000-0x0000000000421000-memory.dmp

Download

memory/2328-189-0x0000000002390000-0x0000000005390000-memory.dmp

Download

memory/2328-58-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/2328-64-0x0000000002390000-0x0000000005390000-memory.dmp

Download

memory/2332-11-0x0000000002220000-0x0000000005220000-memory.dmp

Download

memory/2332-19-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/2684-0-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download

memory/2684-1-0x0000000001B50000-0x0000000001B51000-memory.dmp

Download