Analysis

  • max time kernel
    135s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 04:14

General

  • Target

    eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe

  • Size

    1.7MB

  • MD5

    d78a74b7f328b003ca4b95e7454f76ac

  • SHA1

    7056f17a06e0b231990c51f0b73f8d24ffe362d3

  • SHA256

    eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c

  • SHA512

    6d48dd541ca1195b6a5ad78901bfda0f4d65c99e4d411ad105e2bc200c33fe9539c1d87351422c2dbe9366222bb2663d44a7fd5a329075c1273fad7117fe4612

  • SSDEEP

    49152:gKxNuLkTcKb4rSUfkVFju/snji6attJM:dfuLkT5NUQcEnW6at

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe
    "C:\Users\Admin\AppData\Local\Temp\eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Program Files\Java\jre-1.8\bin\javaws.exe
      "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

    Filesize

    896B

    MD5

    986f154e080a476c6b7f1df40c106180

    SHA1

    dd4aa6c05a8f9ef6055e73af49406270b25c5aed

    SHA256

    2b87c3ac1a756c116fdc55e767994173dea0b8197cd3c0e0e74cdb173f617be3

    SHA512

    7ece4ad8996e59fa2ff61c86d846ce7f093c291d127b87725e29aef270f04e9edc5705a7ef8e116f79018ab63280329b873ef3146ae14e61752a34955e012cf7

  • C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar

    Filesize

    12KB

    MD5

    a66e19c05f3e0b24ac077a37c2b7589e

    SHA1

    8b9ad1517985c48c0bd11670fabd3648bac9d1ff

    SHA256

    9771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126

    SHA512

    0876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f

  • C:\Users\Admin\AppData\Local\Temp\jusched.log

    Filesize

    164KB

    MD5

    431ab73c78adee4205814b103b0d242d

    SHA1

    3e669465ac0cec7a5a1d4bcd3fa15b06a8ddbeb6

    SHA256

    09685020d9ae64ffcdb33502d6de536fe0f10d124d36c1db828957789769df40

    SHA512

    c566168606225c59ce58f1b5833e4f80b6ea25a7625fd9a8ab2427b7efcf4295cab90afad6cfd1169b532baa6621474047392b3fbbbda749d01fc2373956ede6

  • memory/924-24-0x0000028A48F50000-0x0000028A491C0000-memory.dmp

    Filesize

    2.4MB

  • memory/924-54-0x0000028A48BD0000-0x0000028A48BD1000-memory.dmp

    Filesize

    4KB

  • memory/924-280-0x0000028A48BD0000-0x0000028A48BD1000-memory.dmp

    Filesize

    4KB

  • memory/924-323-0x0000028A48BD0000-0x0000028A48BD1000-memory.dmp

    Filesize

    4KB

  • memory/924-347-0x0000028A48BD0000-0x0000028A48BD1000-memory.dmp

    Filesize

    4KB

  • memory/924-368-0x0000028A48BD0000-0x0000028A48BD1000-memory.dmp

    Filesize

    4KB

  • memory/924-369-0x0000028A48F50000-0x0000028A491C0000-memory.dmp

    Filesize

    2.4MB

  • memory/1148-0-0x0000000000400000-0x00000000005BB000-memory.dmp

    Filesize

    1.7MB

  • memory/1148-370-0x0000000000400000-0x00000000005BB000-memory.dmp

    Filesize

    1.7MB