2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90

General

Target

2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe
Size

1.7MB
MD5

0dc953c564fe9994af8644dba74f9966
SHA1

a7555a5312168ebf067456f93ea743b83956bde5
SHA256

2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90
SHA512

7d3919a27459c375e2231fe9afa7aa0a23fd3c8f81a48683cdaa99bcb05d9f7e34e521dad8a998f4a47340940877679e51216eac57c38983a842250463d0ed15
SSDEEP

49152:pKxNuLkTcKb4rSUfkVFj/ErvL73RLSo+2fhl:AfuLkT5NUQOrvvRe12fD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1300	javaws.exe
1300	javaws.exe
1416	jp2launcher.exe
1416	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	jp2launcher.exe
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe
2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1300	2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe	84
PID 2288 wrote to memory of 1300	2288	2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe	84
PID 1300 wrote to memory of 1416	1300	javaws.exe	85
PID 1300 wrote to memory of 1416	1300	javaws.exe	85

C:\Users\Admin\AppData\Local\Temp\2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe
"C:\Users\Admin\AppData\Local\Temp\2aec1d24d6b38c9e479153e6fd4d36290a40dc930a4b7968cda04b49960a8d90.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
896B

MD5
e13ce03ceb80fe09a76c4c6a493c7b57

SHA1
f9b2b748f06ff20c49bba14a0d0095a471e6400f

SHA256
c1bd47795147af0074b0f312afaed4666ecca7b116b40fd50537522f5dc86449

SHA512
a0c5ceec34e1297b16ae8544ea407f383eaa3d6772f8f94549869397fad747ebcd7492d0a224a79ce3918e70fe27c5a0f9fd2db3377832f501fc0f41a6788ab4

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
a66e19c05f3e0b24ac077a37c2b7589e

SHA1
8b9ad1517985c48c0bd11670fabd3648bac9d1ff

SHA256
9771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126

SHA512
0876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
164KB

MD5
cc68fdead5893e2a289448c6e9a26ebb

SHA1
7c5b3dd35bc986a209b016cca429e4a1c32cd28a

SHA256
a138cf5e95813a4752e8458565dccaf5161c4926dfd97cab2a70dfe17a3b3d9b

SHA512
fc6ea5f8c6252474089f6aa679b07d22825b4af950da2997d7750ba92e959f7f68765ba439d256b21bc24c8f287f8360ca48c840b609f4e757104102819373e9

Download Submit
memory/1416-20-0x000002A000000000-0x000002A000270000-memory.dmp

Filesize
2.4MB

Download
memory/1416-85-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-280-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-315-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-324-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-345-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-369-0x000002A0778C0000-0x000002A0778C1000-memory.dmp

Filesize
4KB

Download
memory/1416-370-0x000002A000000000-0x000002A000270000-memory.dmp

Filesize
2.4MB

Download
memory/2288-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/2288-371-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing