55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
578s
max time network
583s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/deploy/messages_ko.jnlp
Size 5KB
Sample240319-12pgdsha44
SHA256 292696c94d5fd0bf2ff4af9e4d363bfcbe888d2e65bd18a20cf71081fb1c9b0d
MD5 64de22212ee92f29bca3aced72737254
SHA1 c4dbc247043578ccf9cd8dab652d096703d5b26e
SHA512 ca33c75b66d8b5316b1c3ed41a9a14dd8611a3bb9b26efdc7f468250696d515cf1e966831975c9abdc33e9a1c59167fe79ba547592d2a04997e1342433e7b628
SSDEEP 96:GhymCk3kjLqgz9RkfrsEW/p9M32i0HkZr+ywc8b8+/moD7yct070DL70Dm:Dm5kLfIErMbT/44in
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
532	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	jp2launcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	jp2launcher.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4940	javaws.exe
4940	javaws.exe
4940	javaws.exe
4940	javaws.exe
1576	javaws.exe
1576	javaws.exe
2288	jp2launcher.exe
2288	jp2launcher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2288	jp2launcher.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 116 wrote to memory of 4940	116	jp2launcher.exe	90
PID 116 wrote to memory of 4940	116	jp2launcher.exe	90
PID 4940 wrote to memory of 1504	4940	javaws.exe	100
PID 4940 wrote to memory of 1504	4940	javaws.exe	100
PID 1504 wrote to memory of 532	1504	javaw.exe	102
PID 1504 wrote to memory of 532	1504	javaw.exe	102
PID 4940 wrote to memory of 4320	4940	javaws.exe	104
PID 4940 wrote to memory of 4320	4940	javaws.exe	104
PID 4940 wrote to memory of 3120	4940	javaws.exe	105
PID 4940 wrote to memory of 3120	4940	javaws.exe	105
PID 4940 wrote to memory of 1576	4940	javaws.exe	106
PID 4940 wrote to memory of 1576	4940	javaws.exe	106
PID 4940 wrote to memory of 2288	4940	javaws.exe	107
PID 4940 wrote to memory of 2288	4940	javaws.exe	107

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -securejws "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_ko.jnlp"
1⤵
- Suspicious use of WriteProcessMemory
PID:116
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" "C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\deploy\messages_ko.jnlp"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.11.381.2" "later"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:532
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.timestamp.11.381.2" "1710886687"
    3⤵
    PID:4320
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -cp "C:\PROGRA~1\Java\jre-1.8\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -userConfig "deployment.expiration.decision.suppression.11.381.2" "false"
    3⤵
    PID:3120
- - C:\Program Files\Java\jre-1.8\bin\javaws.exe
    JavaWSSplashScreen -splash 65500 "C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1576
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURqbmxweC5vcmlnRmlsZW5hbWVBcmc9QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXCRURU1QXEZlZWxpbmdFeWVzdHJhaW4tTGF1bmNoZXJcdTU3MVxsaWJcZGVwbG95XG1lc3NhZ2VzX2tvLmpubHAALURqbmxweC5yZW1vdmU9ZmFsc2UALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1Eam5scHguc3BsYXNocG9ydD02NTUwMQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW5camF2YXcuZXhl -ma QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXCRURU1QXEZlZWxpbmdFeWVzdHJhaW4tTGF1bmNoZXJcdTU3MVxsaWJcZGVwbG95XG1lc3NhZ2VzX2tvLmpubHA=
    3⤵
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 fd007c088e6a71c2e70dff3d9cb43eb756313d4ee4c468410a3ce8ba97b192ac
MD5 8c8120f840fef55e8be012ef3ee28444
SHA1 19ec0944a3d7e9bfe6f0fda6df8a451ec08d00ca
SHA512 be71d40c1fe527fe9fc84556800cc1416ff9eddacb2570b31ad86d83ef2a8f68a63bad0f56689eab5fbd8f4a4a82cf02a4855a283aa2ec18d012f8069ac74331
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 d18a7cff3c072c37912f76701313e278bd8e97564b7a07840d80702210949eed
MD5 61d1cc414b24f86e72b57bfb1df23f5d
SHA1 97c82abadd3c09257e0090660d01aebf361d97aa
SHA512 1f87bb0f63f2767e65db392793d1f6307c530efa9c30cc55541c3b13f0fcef0823bd12df74ada848a5fd476eefb8db0ecf122c631c95b1526d66a1780fa14ea8
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 74e0d665d04f64b6b8c46fdf44a5bcfa59c455a5080fe98f7fc82389d87d58cd
MD5 9893185a214c8f899d7a5cc3575267f5
SHA1 c3fbe79f2d00ae8a87a13487285c54918b41f013
SHA512 fd8991ed2803fcd930652762926aed4fd04269a8038be8d489d80c49004c9a465fdbe4e578abb99d6a1df7f4ab6b7e8e60be1ca69ecdec56d2d4bb17c43e4e95
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 775B
SHA256 8efa10e356ac72e1bfb3914bf914f28d805dabd4083a692b454289843c689b17
MD5 7320c2447df81f97ef29bde79c69f1e7
SHA1 0573ebd6247d290a1aa6ba75ead2d739d1304f7f
SHA512 ddd28100429908a775145d7a3210cf84a635518dd925db7b32cf4be9723d68497b82b5bde8ba3b6e30b3c3c38cfe23772861498c6e252e501470653c3730a6b1
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 837B
SHA256 9e11ea84e9f1366afe5c720e2d7d26807670f001b65e829b0e01a8ef1995bb06
MD5 d692e3f8c687133ebc4fcbf7d3fa22bf
SHA1 fc8d22e71e679f6b38d7115cd85e435516c80f73
SHA512 5f905cda36cf4c4f1608a4d703417af5d1ffbd541e969eeba3024b8a4f39b012aaea5dd062042b8d8ac927e2549137d2c75846effd909d52f8b5b86823d01094
MD5 SHA1 SHA512

Submit Download

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 8bf62674e997824d46d763171e3591f915d166e7a4d39e42fd941691b887cdac
MD5 ce34ed4dbac1f1e5540858181fb80427
SHA1 3d815128e3799480c381c4bbb01f8e312a2b0162
SHA512 627cd0cd169036d4ff8b23d0bb96bd3cc1d6c9d3e41fe26167974f804a799ae2d273e46ef5d842b4b761b33015cf9a1f31af4f1ed9677f06b9b151877bfa24cc
MD5 SHA1 SHA512

Submit Download

memory/1504-15-0x000002D943BF0000-0x000002D943BF1000-memory.dmp

Download

memory/1504-4-0x000002D943C10000-0x000002D944C10000-memory.dmp

Download

memory/2288-71-0x0000021AB34F0000-0x0000021AB44F0000-memory.dmp

Download

memory/2288-109-0x0000021AB34F0000-0x0000021AB44F0000-memory.dmp

Download

memory/2288-112-0x0000021AB34F0000-0x0000021AB44F0000-memory.dmp

Download

memory/2288-111-0x0000021AB37A0000-0x0000021AB37B0000-memory.dmp

Download

memory/2288-110-0x0000021AB3790000-0x0000021AB37A0000-memory.dmp

Download

memory/2288-83-0x0000021AB1760000-0x0000021AB1761000-memory.dmp

Download

memory/2288-84-0x0000021AB1760000-0x0000021AB1761000-memory.dmp

Download

memory/2288-97-0x0000021AB1760000-0x0000021AB1761000-memory.dmp

Download

memory/2288-102-0x0000021AB34F0000-0x0000021AB44F0000-memory.dmp

Download

memory/2288-108-0x0000021AB3770000-0x0000021AB3780000-memory.dmp

Download

memory/3120-65-0x0000020F2FD80000-0x0000020F2FD81000-memory.dmp

Download

memory/3120-52-0x0000020F315D0000-0x0000020F325D0000-memory.dmp

Download

memory/4320-43-0x00000201B32B0000-0x00000201B32B1000-memory.dmp

Download

memory/4320-27-0x00000201B4B20000-0x00000201B5B20000-memory.dmp

Download