0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01

General

Target

0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
Size

1.7MB
MD5

2feb6443750377501c32d6459fadfffd
SHA1

abc41ac6b0f68fa90b218924defd2e18ce6ef2d9
SHA256

0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01
SHA512

8b7ea9df9486e4a3278114f93f4f2e15d8d41d6a6227b90f01251937f8a0f83a15de53e9096e730742d1acd479b91e0d067110a999d74628b22a4c6aac14dbeb
SSDEEP

49152:tKxNuLkTcKb4rSUfkVFjLCks7R9L58UqFJjskU:kfuLkT5NUQhC17DVqFJU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4460	javaws.exe
4460	javaws.exe
440	jp2launcher.exe
440	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
440	jp2launcher.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 4460	4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe	84
PID 4204 wrote to memory of 4460	4204	0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe	84
PID 4460 wrote to memory of 440	4460	javaws.exe	85
PID 4460 wrote to memory of 440	4460	javaws.exe	85

C:\Users\Admin\AppData\Local\Temp\0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe
"C:\Users\Admin\AppData\Local\Temp\0ffe2832e1f8a26b2fe8906d61cbf995f524f9d299779fb03dd70430c41ecd01.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

Filesize
896B

MD5
49da2196d1e61f65191c612d20d90d2e

SHA1
16b7a9da7593bb8acff5f00f9ce7733ce797dda9

SHA256
922f5310bde615283236714d614a75937011c610763d0ba8e0368921ca96f717

SHA512
8ad6baaf88af74a2b0401f84dad825306e78bfdad7b6c76e8acbf2ceb0046b89f5e3a39df90b6a00bf0bc26f972254175a5b65dbf159c755195e0b80a5f76523

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

Filesize
12KB

MD5
a66e19c05f3e0b24ac077a37c2b7589e

SHA1
8b9ad1517985c48c0bd11670fabd3648bac9d1ff

SHA256
9771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126

SHA512
0876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
164KB

MD5
2d78035c33004a13df30750a5317a6a5

SHA1
1e0683133559a18be84d2eca0e1cefdfa0d7688b

SHA256
5dadce43269e2ff709442c54975ac6262be4634a2672d0b8df8b53a1945dc3f5

SHA512
89dd23b1f17a4c23b39632b65bde2ad285739a87cd3026d27cc758edc07418cb298ae39eab682d86e55e01756510677c738843b4b18a9954656ed73748e55d66

Download Submit
memory/440-20-0x0000022A14FA0000-0x0000022A15210000-memory.dmp

Filesize
2.4MB

Download
memory/440-261-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-278-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-313-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-322-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-343-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-367-0x0000022A14AD0000-0x0000022A14AD1000-memory.dmp

Filesize
4KB

Download
memory/440-368-0x0000022A14FA0000-0x0000022A15210000-memory.dmp

Filesize
2.4MB

Download
memory/4204-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4204-369-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing