Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/06/2024, 07:22

General

  • Target

    WebModuleBrowser.exe

  • Size

    7.4MB

  • MD5

    833de83d9255cbf8460b1c5847de8d4b

  • SHA1

    b31ec31d0663802b21ea2aeed37377460025a6da

  • SHA256

    2e3b753447ccd7d4a766dce1392d884fc6a3632d858f77ad19465a6504708ae6

  • SHA512

    8bb0e6591fdb344f9b1d55cc78937ad4ae2205294f0d67553a80c73a3c8fbc5bdb23b87eb1f433ee0017e76423b5ee7d96217e7234c2b0ba599500361f67e736

  • SSDEEP

    98304:8iKKwZccnGtg57ET+AjfN7TBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRRn:8RZccQFZ9TVHJack+YlGlSRRbCvU

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WebModuleBrowser.exe
    "C:\Users\Admin\AppData\Local\Temp\WebModuleBrowser.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\WebModuleBrowser.exe" org.develnext.jphp.ext.javafx.FXLauncher
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:2416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\d197583f953320069dba662e8567830f.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath 'C:\'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    19417f189b8d3c7e08fdf39a410f3c3e

    SHA1

    5c21eb00ba14200b0a7b3c204c4ae8402308dc16

    SHA256

    680badea33b66a63accf019980939f73cdd688b6d5b95de14f28186763a3cc1f

    SHA512

    4fdb047e83a609d47482e3b8cf931d272bbc54359cfa51282795f26747df9b108a765d07f4ea9b0a9989aecc04372f2da2af657e9098775038f2bd8dc7e222ff

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ou2thyh4.t2v.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\d197583f953320069dba662e8567830f.bat

    Filesize

    144B

    MD5

    2cb6fa89d02caea13770b09371923222

    SHA1

    7c3510c55537601bfc3b12361a170057f4736e99

    SHA256

    27291f25d8c4c13bcc25f0267ab7c5a369fe6bd752da89f1751ed6b3f614de81

    SHA512

    8060273a0fc363cc9e2ec9edd56cebe66d381c9fcb2c62c4f25594e0ab7cb9ab9a50cf13e96a682ba9b8753ee276a04346ed43621a9d23aed92837acc13eba7c

  • memory/1516-3-0x0000027C17030000-0x0000027C172A0000-memory.dmp

    Filesize

    2.4MB

  • memory/1516-13-0x0000027C157F0000-0x0000027C157F1000-memory.dmp

    Filesize

    4KB

  • memory/1516-16-0x0000027C172A0000-0x0000027C172B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-18-0x0000027C172B0000-0x0000027C172C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-20-0x0000027C172C0000-0x0000027C172D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-23-0x0000027C172D0000-0x0000027C172E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-27-0x0000027C172E0000-0x0000027C172F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-31-0x0000027C172F0000-0x0000027C17300000-memory.dmp

    Filesize

    64KB

  • memory/1516-32-0x0000027C17300000-0x0000027C17310000-memory.dmp

    Filesize

    64KB

  • memory/1516-34-0x0000027C17310000-0x0000027C17320000-memory.dmp

    Filesize

    64KB

  • memory/1516-37-0x0000027C17320000-0x0000027C17330000-memory.dmp

    Filesize

    64KB

  • memory/1516-43-0x0000027C17340000-0x0000027C17350000-memory.dmp

    Filesize

    64KB

  • memory/1516-45-0x0000027C17350000-0x0000027C17360000-memory.dmp

    Filesize

    64KB

  • memory/1516-44-0x0000027C172A0000-0x0000027C172B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-42-0x0000027C17330000-0x0000027C17340000-memory.dmp

    Filesize

    64KB

  • memory/1516-41-0x0000027C17030000-0x0000027C172A0000-memory.dmp

    Filesize

    2.4MB

  • memory/1516-48-0x0000027C17360000-0x0000027C17370000-memory.dmp

    Filesize

    64KB

  • memory/1516-47-0x0000027C172B0000-0x0000027C172C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-51-0x0000027C17370000-0x0000027C17380000-memory.dmp

    Filesize

    64KB

  • memory/1516-50-0x0000027C172C0000-0x0000027C172D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-54-0x0000027C17380000-0x0000027C17390000-memory.dmp

    Filesize

    64KB

  • memory/1516-53-0x0000027C172D0000-0x0000027C172E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-56-0x0000027C172E0000-0x0000027C172F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-57-0x0000027C17390000-0x0000027C173A0000-memory.dmp

    Filesize

    64KB

  • memory/1516-63-0x0000027C173B0000-0x0000027C173C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-65-0x0000027C173C0000-0x0000027C173D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-64-0x0000027C17300000-0x0000027C17310000-memory.dmp

    Filesize

    64KB

  • memory/1516-62-0x0000027C173A0000-0x0000027C173B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-61-0x0000027C172F0000-0x0000027C17300000-memory.dmp

    Filesize

    64KB

  • memory/1516-69-0x0000027C17310000-0x0000027C17320000-memory.dmp

    Filesize

    64KB

  • memory/1516-71-0x0000027C173E0000-0x0000027C173F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-70-0x0000027C173D0000-0x0000027C173E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-75-0x0000027C173F0000-0x0000027C17400000-memory.dmp

    Filesize

    64KB

  • memory/1516-74-0x0000027C17340000-0x0000027C17350000-memory.dmp

    Filesize

    64KB

  • memory/1516-73-0x0000027C17320000-0x0000027C17330000-memory.dmp

    Filesize

    64KB

  • memory/1516-79-0x0000027C17330000-0x0000027C17340000-memory.dmp

    Filesize

    64KB

  • memory/1516-80-0x0000027C17400000-0x0000027C17410000-memory.dmp

    Filesize

    64KB

  • memory/1516-83-0x0000027C17350000-0x0000027C17360000-memory.dmp

    Filesize

    64KB

  • memory/1516-84-0x0000027C17410000-0x0000027C17420000-memory.dmp

    Filesize

    64KB

  • memory/1516-88-0x0000027C17420000-0x0000027C17430000-memory.dmp

    Filesize

    64KB

  • memory/1516-87-0x0000027C17360000-0x0000027C17370000-memory.dmp

    Filesize

    64KB

  • memory/1516-92-0x0000027C17370000-0x0000027C17380000-memory.dmp

    Filesize

    64KB

  • memory/1516-94-0x0000027C17440000-0x0000027C17450000-memory.dmp

    Filesize

    64KB

  • memory/1516-93-0x0000027C17430000-0x0000027C17440000-memory.dmp

    Filesize

    64KB

  • memory/1516-91-0x0000027C157F0000-0x0000027C157F1000-memory.dmp

    Filesize

    4KB

  • memory/1516-99-0x0000027C17450000-0x0000027C17460000-memory.dmp

    Filesize

    64KB

  • memory/1516-100-0x0000027C17460000-0x0000027C17470000-memory.dmp

    Filesize

    64KB

  • memory/1516-98-0x0000027C17380000-0x0000027C17390000-memory.dmp

    Filesize

    64KB

  • memory/1516-103-0x0000027C17470000-0x0000027C17480000-memory.dmp

    Filesize

    64KB

  • memory/1516-102-0x0000027C173B0000-0x0000027C173C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-101-0x0000027C17390000-0x0000027C173A0000-memory.dmp

    Filesize

    64KB

  • memory/1516-105-0x0000027C173A0000-0x0000027C173B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-106-0x0000027C17480000-0x0000027C17490000-memory.dmp

    Filesize

    64KB

  • memory/1516-112-0x0000027C173C0000-0x0000027C173D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-114-0x0000027C174A0000-0x0000027C174B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-113-0x0000027C17490000-0x0000027C174A0000-memory.dmp

    Filesize

    64KB

  • memory/1516-117-0x0000027C173D0000-0x0000027C173E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-119-0x0000027C174B0000-0x0000027C174C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-118-0x0000027C173E0000-0x0000027C173F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-120-0x0000027C157F0000-0x0000027C157F1000-memory.dmp

    Filesize

    4KB

  • memory/1516-122-0x0000027C173F0000-0x0000027C17400000-memory.dmp

    Filesize

    64KB

  • memory/1516-123-0x0000027C174C0000-0x0000027C174D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-128-0x0000027C174E0000-0x0000027C174F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-127-0x0000027C174D0000-0x0000027C174E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-126-0x0000027C17400000-0x0000027C17410000-memory.dmp

    Filesize

    64KB

  • memory/1516-132-0x0000027C17410000-0x0000027C17420000-memory.dmp

    Filesize

    64KB

  • memory/1516-134-0x0000027C17500000-0x0000027C17510000-memory.dmp

    Filesize

    64KB

  • memory/1516-133-0x0000027C174F0000-0x0000027C17500000-memory.dmp

    Filesize

    64KB

  • memory/1516-138-0x0000027C17520000-0x0000027C17530000-memory.dmp

    Filesize

    64KB

  • memory/1516-137-0x0000027C17510000-0x0000027C17520000-memory.dmp

    Filesize

    64KB

  • memory/1516-136-0x0000027C17420000-0x0000027C17430000-memory.dmp

    Filesize

    64KB

  • memory/1516-140-0x0000027C17430000-0x0000027C17440000-memory.dmp

    Filesize

    64KB

  • memory/1516-143-0x0000027C17530000-0x0000027C17540000-memory.dmp

    Filesize

    64KB

  • memory/1516-141-0x0000027C17440000-0x0000027C17450000-memory.dmp

    Filesize

    64KB

  • memory/1516-148-0x0000027C17460000-0x0000027C17470000-memory.dmp

    Filesize

    64KB

  • memory/1516-152-0x0000027C17560000-0x0000027C17570000-memory.dmp

    Filesize

    64KB

  • memory/1516-151-0x0000027C17550000-0x0000027C17560000-memory.dmp

    Filesize

    64KB

  • memory/1516-150-0x0000027C17540000-0x0000027C17550000-memory.dmp

    Filesize

    64KB

  • memory/1516-147-0x0000027C17450000-0x0000027C17460000-memory.dmp

    Filesize

    64KB

  • memory/1516-155-0x0000027C17580000-0x0000027C17590000-memory.dmp

    Filesize

    64KB

  • memory/1516-156-0x0000027C17590000-0x0000027C175A0000-memory.dmp

    Filesize

    64KB

  • memory/1516-154-0x0000027C17470000-0x0000027C17480000-memory.dmp

    Filesize

    64KB

  • memory/1516-164-0x0000027C17570000-0x0000027C17580000-memory.dmp

    Filesize

    64KB

  • memory/1516-163-0x0000027C175C0000-0x0000027C175D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-162-0x0000027C175B0000-0x0000027C175C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-161-0x0000027C175A0000-0x0000027C175B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-160-0x0000027C17480000-0x0000027C17490000-memory.dmp

    Filesize

    64KB

  • memory/1516-169-0x0000027C175D0000-0x0000027C175E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-168-0x0000027C174A0000-0x0000027C174B0000-memory.dmp

    Filesize

    64KB

  • memory/1516-167-0x0000027C17490000-0x0000027C174A0000-memory.dmp

    Filesize

    64KB

  • memory/1516-174-0x0000027C175E0000-0x0000027C175F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-173-0x0000027C175F0000-0x0000027C17600000-memory.dmp

    Filesize

    64KB

  • memory/1516-172-0x0000027C174B0000-0x0000027C174C0000-memory.dmp

    Filesize

    64KB

  • memory/1516-177-0x0000027C17600000-0x0000027C17610000-memory.dmp

    Filesize

    64KB

  • memory/1516-176-0x0000027C174C0000-0x0000027C174D0000-memory.dmp

    Filesize

    64KB

  • memory/1516-182-0x0000027C17610000-0x0000027C17620000-memory.dmp

    Filesize

    64KB

  • memory/1516-181-0x0000027C174E0000-0x0000027C174F0000-memory.dmp

    Filesize

    64KB

  • memory/1516-180-0x0000027C174D0000-0x0000027C174E0000-memory.dmp

    Filesize

    64KB

  • memory/1516-184-0x0000027C174F0000-0x0000027C17500000-memory.dmp

    Filesize

    64KB

  • memory/1516-193-0x0000027C157F0000-0x0000027C157F1000-memory.dmp

    Filesize

    4KB

  • memory/1516-259-0x0000027C157F0000-0x0000027C157F1000-memory.dmp

    Filesize

    4KB

  • memory/5032-0-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB