af08b368268b991c97575076f027730b5e39174110c911a116e62fc8d94b02e5

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre-8u162-windows-x64.exe
Size

68.3MB
MD5

5f1f203d69824451b2e0c5bfc0423b40
SHA1

f3cb0f6e2773b4885e436986a67f3aea48a28dbb
SHA256

af08b368268b991c97575076f027730b5e39174110c911a116e62fc8d94b02e5
SHA512

a9bf6cf595cf4aa557f0f8d3ad1307d39001bd30b347ab695e27bd9f0548d1891e6c94bd45ca79e125f8f7645976e2b548ddd50b4ea436435976c8743322eae1
SSDEEP

1572864:rRBo4dlrJGbi/2a5qtOn3rSxNGgdMl2V3DfRQwv:rRBB9V2I3rSlFN9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2108	jre-8u162-windows-x64.exe
1196	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
2408	jre-8u162-windows-x64.exe
1196	Process not Found

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	jre-8u162-windows-x64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2108	jre-8u162-windows-x64.exe
2108	jre-8u162-windows-x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2108	2408	jre-8u162-windows-x64.exe	28
PID 2408 wrote to memory of 2108	2408	jre-8u162-windows-x64.exe	28
PID 2408 wrote to memory of 2108	2408	jre-8u162-windows-x64.exe	28

C:\Users\Admin\AppData\Local\Temp\jre-8u162-windows-x64.exe
"C:\Users\Admin\AppData\Local\Temp\jre-8u162-windows-x64.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\jds259402393.tmp\jre-8u162-windows-x64.exe
  "C:\Users\Admin\AppData\Local\Temp\jds259402393.tmp\jre-8u162-windows-x64.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
6KB

MD5
43eca5b06309c449ce88c2d6f02c3659

SHA1
97291a0fa31c7d56277c4a7a18cca2c341c352ad

SHA256
dc0e582a873e38e1a48898db4fdbb44e4dc71383950262977442779d15b64957

SHA512
3a0841bb0348aa90e03c1a7b20c53c1a3e0be44ef0b114d4272db1723711bc064d875f2d0499aa5c4ed66d4dc6f74abc729f7535d886f285b4575719bafd8ecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
1KB

MD5
4497bb27343bf785ddf0270acf868dca

SHA1
2088711e7accfa75f6cbd57947cc6b33fad1086d

SHA256
a13fbc1d4d06a1e70e278a7d270297c4c81e612342d3a4e4105192919e16768c

SHA512
9aa8723ae35c6e982cdd47627d6fd0e0c651f65dfd33765c77127d47dba8bdc52cd0f2edf7568c738e0a71bfdc64cdb46c8450e8a61638381b92833cf93d994a

Download Submit