5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050

General

Target

5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe
Size

1.7MB
MD5

bfea6693ab52eb5c7fcfc53a3ebd60cd
SHA1

54d538926b45042d4a1e48a35813f0676504fbba
SHA256

5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050
SHA512

bcb2fe4dd0dbb52ddc4aef18014de7f7c2b53698d714037a13af383f30852507e9fcf9ebb63e2220b6caa77a6b16655c7f512bda2dc89585887952efcf6eb95b
SSDEEP

24576:0Wd7S8NK3oYLkTcDvebZI7LrS/85RkVt7j2sqjnhMgeiCl7G0nehbGZpbD:0KxNuLkTcKb4rSUfkVFj6Dmg27RnWGj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
432	javaws.exe
432	javaws.exe
3092	jp2launcher.exe
3092	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3092	jp2launcher.exe
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe
4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 432	4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe	83
PID 4372 wrote to memory of 432	4372	5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe	83
PID 432 wrote to memory of 3092	432	javaws.exe	84
PID 432 wrote to memory of 3092	432	javaws.exe	84

C:\Users\Admin\AppData\Local\Temp\5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe
"C:\Users\Admin\AppData\Local\Temp\5b75791f3c7b526e8706692cd0a98c537c68caac142c84c30374d8eb3ef9d050.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
896B

MD5
fd8c59b97ae878f7810cf432cd08eaa1

SHA1
7cad136157716a74ecedbb3321847f6e921c2d25

SHA256
77a6be15f38698249a1dd0f3fc0cb549e8f3ea77206881b1d9ab74abe23ba205

SHA512
442235733a5f7b95f3fc1b086bf674570abc5e0589d615d559b80cdd37dfbdb862e22c92a874d78f1a45a8c992da78a42c9ab0f778671e396c9d05b5ad204e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
00e5f72258e6c602e6841bbf4c30b136

SHA1
52dbdf9eada5d7b0e015fd3523cca5cb915c23c2

SHA256
905a454fcb15e9f2a469a9a7e6e42b8c6425d20b33a59be5b84818daae964807

SHA512
50f0f286680fd33c29956455ca7e2d293402f369bd2e9079e45930853f1feb6e86208e1c8762d26dfc6f7e742044e912a4efded9a55ddfddaa454297cedc60c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
164KB

MD5
7e47f55fe5439c92457fcaa3fd6d169e

SHA1
333de80aecc4a97aa6cf6045f720424e65a87b71

SHA256
e34ab1d39dd3025b24b6eed00fb4eb51f368e2f57f403d5a45c79f656c4bd69a

SHA512
e24dda028a290c2861a0a06b7296f478e09569f036eb87778da70a041aaf226f221bb3c26336fcdaf3e314beb1fc4bd5293e42747c758329eb83f7aab08bcde2

Download Submit
memory/3092-22-0x000001A7BC010000-0x000001A7BC280000-memory.dmp

Filesize
2.4MB

Download
memory/3092-271-0x000001A7BBB50000-0x000001A7BBB51000-memory.dmp

Filesize
4KB

Download
memory/3092-316-0x000001A7BBB50000-0x000001A7BBB51000-memory.dmp

Filesize
4KB

Download
memory/3092-335-0x000001A7BBB50000-0x000001A7BBB51000-memory.dmp

Filesize
4KB

Download
memory/3092-359-0x000001A7BBB50000-0x000001A7BBB51000-memory.dmp

Filesize
4KB

Download
memory/3092-360-0x000001A7BC010000-0x000001A7BC280000-memory.dmp

Filesize
2.4MB

Download
memory/4372-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4372-361-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing