Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2024 21:07

General

  • Target

    270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe

  • Size

    113KB

  • MD5

    7cf417d06a24c1ade73ec6d8ae589077

  • SHA1

    128516790f9c6d8ac1d33a9f1f2b854162d94942

  • SHA256

    270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8

  • SHA512

    3f5615b04489cfc755e19efc30fe619026dfacd250bb1c1677e1c55ceb6f69a80d0f05760c157696985e1090c34e8e403b453e5680fb981f274bdd66e2fcb5bb

  • SSDEEP

    3072:RSb0MKWY3tfR2y+/ESH7V3wy3OcpN4LBzl:44JWGJ+/ESx3wy+c34LBZ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe
    "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
      2⤵
        PID:1640
      • C:\Program Files\Java\jre7\bin\javaw.exe
        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
        2⤵
          PID:1724
        • C:\Program Files\Java\jre7\bin\javaw.exe
          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
          2⤵
            PID:3008
          • C:\Program Files\Java\jre7\bin\javaw.exe
            "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
            2⤵
              PID:2980
            • C:\Program Files\Java\jre7\bin\javaw.exe
              "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
              2⤵
                PID:2656
              • C:\Program Files\Java\jre7\bin\javaw.exe
                "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                2⤵
                  PID:1720
                • C:\Program Files\Java\jre7\bin\javaw.exe
                  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                  2⤵
                    PID:2404
                  • C:\Program Files\Java\jre7\bin\javaw.exe
                    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                    2⤵
                      PID:2676
                    • C:\Program Files\Java\jre7\bin\javaw.exe
                      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                      2⤵
                        PID:2464
                      • C:\Program Files\Java\jre7\bin\javaw.exe
                        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                        2⤵
                          PID:1536
                        • C:\Program Files\Java\jre7\bin\javaw.exe
                          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                          2⤵
                            PID:1040
                          • C:\Program Files\Java\jre7\bin\javaw.exe
                            "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                            2⤵
                              PID:1736
                            • C:\Program Files\Java\jre7\bin\javaw.exe
                              "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                              2⤵
                                PID:2868
                              • C:\Program Files\Java\jre7\bin\javaw.exe
                                "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                2⤵
                                  PID:2196
                                • C:\Program Files\Java\jre7\bin\javaw.exe
                                  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                  2⤵
                                    PID:976
                                  • C:\Program Files\Java\jre7\bin\javaw.exe
                                    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                    2⤵
                                      PID:2604
                                    • C:\Program Files\Java\jre7\bin\javaw.exe
                                      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                      2⤵
                                        PID:1996
                                      • C:\Program Files\Java\jre7\bin\javaw.exe
                                        "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                        2⤵
                                          PID:2444
                                        • C:\Program Files\Java\jre7\bin\javaw.exe
                                          "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                          2⤵
                                            PID:2036
                                          • C:\Program Files\Java\jre7\bin\javaw.exe
                                            "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                            2⤵
                                              PID:2788
                                            • C:\Program Files\Java\jre7\bin\javaw.exe
                                              "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                              2⤵
                                                PID:2820
                                              • C:\Program Files\Java\jre7\bin\javaw.exe
                                                "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                                2⤵
                                                  PID:448
                                                • C:\Program Files\Java\jre7\bin\javaw.exe
                                                  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                                  2⤵
                                                    PID:608
                                                  • C:\Program Files\Java\jre7\bin\javaw.exe
                                                    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\270723a06c0f917204923693f09cc0d6cd2cc9cefd59fc051cfbf920d26f17d8.exe"
                                                    2⤵
                                                      PID:3028

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/448-284-0x0000000000340000-0x0000000000341000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/448-282-0x0000000000340000-0x0000000000341000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/976-194-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/976-196-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1040-143-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1536-131-0x0000000000430000-0x0000000000431000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1536-133-0x0000000000430000-0x0000000000431000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1640-10-0x0000000000140000-0x0000000000141000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1640-2-0x0000000002550000-0x00000000027C0000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/1640-13-0x0000000002550000-0x00000000027C0000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/1720-80-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1720-82-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1724-28-0x00000000025E0000-0x0000000002850000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/1724-27-0x0000000000340000-0x0000000000341000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1724-25-0x0000000000340000-0x0000000000341000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1724-16-0x00000000025E0000-0x0000000002850000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/1736-156-0x0000000001C60000-0x0000000001C61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/1736-158-0x0000000001C60000-0x0000000001C61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2036-246-0x0000000000340000-0x0000000000341000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2196-181-0x0000000001D60000-0x0000000001D61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2288-294-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-155-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-130-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-256-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-53-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-193-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-106-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-68-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-169-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-92-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-211-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-270-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-24-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2288-231-0x0000000000400000-0x000000000041E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/2404-93-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2404-95-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2444-234-0x0000000001B60000-0x0000000001B61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2444-232-0x0000000001B60000-0x0000000001B61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2464-118-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2604-206-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2604-208-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2656-70-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2656-67-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2676-108-0x0000000000140000-0x0000000000141000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2676-105-0x0000000000140000-0x0000000000141000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2788-257-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2788-259-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2868-168-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2868-171-0x0000000000130000-0x0000000000131000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2980-57-0x0000000002510000-0x0000000002780000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/2980-56-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2980-54-0x0000000000230000-0x0000000000231000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2980-45-0x0000000002510000-0x0000000002780000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/3008-42-0x0000000002520000-0x0000000002790000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                  • memory/3008-41-0x0000000001B60000-0x0000000001B61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/3008-39-0x0000000001B60000-0x0000000001B61000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/3008-32-0x0000000002520000-0x0000000002790000-memory.dmp

                                                    Filesize

                                                    2.4MB