Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 04:14
Static task
static1
Behavioral task
behavioral1
Sample
eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe
Resource
win10v2004-20241007-en
General
-
Target
eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe
-
Size
1.7MB
-
MD5
d78a74b7f328b003ca4b95e7454f76ac
-
SHA1
7056f17a06e0b231990c51f0b73f8d24ffe362d3
-
SHA256
eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c
-
SHA512
6d48dd541ca1195b6a5ad78901bfda0f4d65c99e4d411ad105e2bc200c33fe9539c1d87351422c2dbe9366222bb2663d44a7fd5a329075c1273fad7117fe4612
-
SSDEEP
49152:gKxNuLkTcKb4rSUfkVFju/snji6attJM:dfuLkT5NUQcEnW6at
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3960 javaws.exe 3960 javaws.exe 924 jp2launcher.exe 924 jp2launcher.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 924 jp2launcher.exe 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3960 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe 85 PID 1148 wrote to memory of 3960 1148 eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe 85 PID 3960 wrote to memory of 924 3960 javaws.exe 86 PID 3960 wrote to memory of 924 3960 javaws.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe"C:\Users\Admin\AppData\Local\Temp\eeebe2beb9ca6b9d1369658e1f309c7e155491c6c93bcde01d8fa5b31f386f5c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files\Java\jre-1.8\bin\javaws.exe"C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe"C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896B
MD5986f154e080a476c6b7f1df40c106180
SHA1dd4aa6c05a8f9ef6055e73af49406270b25c5aed
SHA2562b87c3ac1a756c116fdc55e767994173dea0b8197cd3c0e0e74cdb173f617be3
SHA5127ece4ad8996e59fa2ff61c86d846ce7f093c291d127b87725e29aef270f04e9edc5705a7ef8e116f79018ab63280329b873ef3146ae14e61752a34955e012cf7
-
Filesize
12KB
MD5a66e19c05f3e0b24ac077a37c2b7589e
SHA18b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA2569771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
SHA5120876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f
-
Filesize
164KB
MD5431ab73c78adee4205814b103b0d242d
SHA13e669465ac0cec7a5a1d4bcd3fa15b06a8ddbeb6
SHA25609685020d9ae64ffcdb33502d6de536fe0f10d124d36c1db828957789769df40
SHA512c566168606225c59ce58f1b5833e4f80b6ea25a7625fd9a8ab2427b7efcf4295cab90afad6cfd1169b532baa6621474047392b3fbbbda749d01fc2373956ede6