Analysis
- max time kernel
258s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/06/2024, 10:20
General
- Target gsea.bat
- Size 293B
- Sample240603-mdfbxscd42
- SHA256 bffa6087d36d03da015953c1d4a1709594a8944f51ee15ffd265a0b526391025
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\gsea.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jdk-11\bin\javaw.exejdk-11\bin\javaw -showversion --module-path=modules -Xmx4g @gsea.args -Djava.util.logging.config.file=logging.properties --patch-module=jide.common=lib\jide-components-3.7.4.jar;lib\jide-dock-3.7.4.jar;lib\jide-grids-3.7.4.jar --module=org.gsea_msigdb.gsea/xapps.gsea.GSEA2⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2632-5-0x0000000008580000-0x00000000087F0000-memory.dmp
memory/2632-14-0x0000000008B10000-0x0000000008D80000-memory.dmp
memory/2632-16-0x0000000010040000-0x00000000102B0000-memory.dmp
memory/2632-22-0x0000000008D80000-0x0000000008D90000-memory.dmp
memory/2632-24-0x0000000008D90000-0x0000000008DA0000-memory.dmp
memory/2632-26-0x0000000000360000-0x000000000036A000-memory.dmp
memory/2632-27-0x0000000000360000-0x000000000036A000-memory.dmp
memory/2632-29-0x0000000008DA0000-0x0000000008DB0000-memory.dmp
memory/2632-31-0x0000000008DB0000-0x0000000008DC0000-memory.dmp
memory/2632-33-0x0000000008DC0000-0x0000000008DD0000-memory.dmp
memory/2632-36-0x0000000008DD0000-0x0000000008DE0000-memory.dmp
memory/2632-38-0x0000000008580000-0x00000000087F0000-memory.dmp
memory/2632-42-0x0000000008DF0000-0x0000000008E00000-memory.dmp
memory/2632-41-0x0000000008DE0000-0x0000000008DF0000-memory.dmp
memory/2632-40-0x0000000008B10000-0x0000000008D80000-memory.dmp
memory/2632-70-0x0000000010040000-0x00000000102B0000-memory.dmp
memory/2632-110-0x0000000008E10000-0x0000000008E20000-memory.dmp
memory/2632-109-0x0000000008D80000-0x0000000008D90000-memory.dmp
memory/2632-80-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/2632-125-0x0000000008E20000-0x0000000008E30000-memory.dmp
memory/2632-124-0x0000000008D90000-0x0000000008DA0000-memory.dmp
memory/2632-129-0x0000000008E30000-0x0000000008E40000-memory.dmp
memory/2632-128-0x0000000000360000-0x000000000036A000-memory.dmp
memory/2632-127-0x0000000000360000-0x000000000036A000-memory.dmp
memory/2632-132-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/2632-131-0x0000000008DA0000-0x0000000008DB0000-memory.dmp
memory/2632-135-0x0000000008E50000-0x0000000008E60000-memory.dmp
memory/2632-134-0x0000000008DB0000-0x0000000008DC0000-memory.dmp
memory/2632-141-0x0000000008E60000-0x0000000008E70000-memory.dmp
memory/2632-140-0x0000000008DC0000-0x0000000008DD0000-memory.dmp
memory/2632-150-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/2632-149-0x0000000008DD0000-0x0000000008DE0000-memory.dmp
memory/2632-152-0x0000000008E80000-0x0000000008E90000-memory.dmp
memory/2632-151-0x0000000008DE0000-0x0000000008DF0000-memory.dmp
memory/2632-155-0x0000000008E90000-0x0000000008EA0000-memory.dmp
memory/2632-154-0x0000000008DF0000-0x0000000008E00000-memory.dmp
memory/2632-158-0x0000000008EA0000-0x0000000008EB0000-memory.dmp
memory/2632-157-0x0000000008E00000-0x0000000008E10000-memory.dmp
memory/2632-161-0x0000000008EB0000-0x0000000008EC0000-memory.dmp
memory/2632-160-0x0000000008E10000-0x0000000008E20000-memory.dmp
memory/2632-164-0x0000000008EC0000-0x0000000008ED0000-memory.dmp
memory/2632-163-0x0000000008E20000-0x0000000008E30000-memory.dmp
memory/2632-166-0x0000000008E30000-0x0000000008E40000-memory.dmp
memory/2632-167-0x0000000008ED0000-0x0000000008EE0000-memory.dmp
memory/2632-170-0x0000000008EE0000-0x0000000008EF0000-memory.dmp
memory/2632-169-0x0000000008E40000-0x0000000008E50000-memory.dmp
memory/2632-175-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/2632-174-0x0000000008EF0000-0x0000000008F00000-memory.dmp
memory/2632-173-0x0000000008E50000-0x0000000008E60000-memory.dmp
memory/2632-179-0x0000000008F10000-0x0000000008F20000-memory.dmp
memory/2632-178-0x0000000008E60000-0x0000000008E70000-memory.dmp
memory/2632-181-0x0000000008E70000-0x0000000008E80000-memory.dmp
memory/2632-180-0x0000000008F20000-0x0000000008F30000-memory.dmp
memory/2632-183-0x0000000008E80000-0x0000000008E90000-memory.dmp
memory/2632-184-0x0000000008F30000-0x0000000008F40000-memory.dmp
memory/2632-187-0x0000000008F40000-0x0000000008F50000-memory.dmp
memory/2632-186-0x0000000008E90000-0x0000000008EA0000-memory.dmp
memory/2632-190-0x0000000008F50000-0x0000000008F60000-memory.dmp
memory/2632-189-0x0000000008EA0000-0x0000000008EB0000-memory.dmp
memory/2632-193-0x0000000008F60000-0x0000000008F70000-memory.dmp
memory/2632-192-0x0000000008EB0000-0x0000000008EC0000-memory.dmp
memory/2632-196-0x0000000008F70000-0x0000000008F80000-memory.dmp
memory/2632-195-0x0000000008EC0000-0x0000000008ED0000-memory.dmp
memory/2632-198-0x0000000008ED0000-0x0000000008EE0000-memory.dmp
memory/2632-199-0x0000000008F80000-0x0000000008F90000-memory.dmp
memory/2632-202-0x0000000008EE0000-0x0000000008EF0000-memory.dmp
memory/2632-204-0x0000000008FA0000-0x0000000008FB0000-memory.dmp
memory/2632-203-0x0000000008F90000-0x0000000008FA0000-memory.dmp
memory/2632-207-0x0000000008EF0000-0x0000000008F00000-memory.dmp
memory/2632-210-0x0000000008FC0000-0x0000000008FD0000-memory.dmp
memory/2632-211-0x0000000008F10000-0x0000000008F20000-memory.dmp
memory/2632-209-0x0000000008FB0000-0x0000000008FC0000-memory.dmp
memory/2632-208-0x0000000008F00000-0x0000000008F10000-memory.dmp
memory/2632-214-0x0000000008FD0000-0x0000000008FE0000-memory.dmp
memory/2632-213-0x0000000008F20000-0x0000000008F30000-memory.dmp
memory/2632-217-0x0000000008FE0000-0x0000000008FF0000-memory.dmp
memory/2632-216-0x0000000008F30000-0x0000000008F40000-memory.dmp
memory/2632-222-0x0000000009000000-0x0000000009010000-memory.dmp
memory/2632-221-0x0000000008FF0000-0x0000000009000000-memory.dmp
memory/2632-220-0x0000000008F40000-0x0000000008F50000-memory.dmp
memory/2632-227-0x0000000009020000-0x0000000009030000-memory.dmp
memory/2632-226-0x0000000009010000-0x0000000009020000-memory.dmp
memory/2632-225-0x0000000008F50000-0x0000000008F60000-memory.dmp
memory/2632-231-0x0000000009030000-0x0000000009040000-memory.dmp
memory/2632-230-0x0000000008F60000-0x0000000008F70000-memory.dmp
memory/2632-236-0x0000000009040000-0x0000000009050000-memory.dmp
memory/2632-235-0x0000000008F70000-0x0000000008F80000-memory.dmp
memory/2632-242-0x0000000009060000-0x0000000009070000-memory.dmp
memory/2632-241-0x0000000009050000-0x0000000009060000-memory.dmp
memory/2632-240-0x0000000008F80000-0x0000000008F90000-memory.dmp
memory/2632-247-0x0000000009070000-0x0000000009080000-memory.dmp
memory/2632-245-0x0000000008FA0000-0x0000000008FB0000-memory.dmp
memory/2632-244-0x0000000008F90000-0x0000000008FA0000-memory.dmp
memory/2632-250-0x0000000008FB0000-0x0000000008FC0000-memory.dmp
memory/2632-252-0x0000000009080000-0x0000000009090000-memory.dmp
memory/2632-254-0x0000000008FC0000-0x0000000008FD0000-memory.dmp