Overview

overview

7

Static

static

3

54 45 53 5...22.exe

windows10-2004-x64

3

54 45 53 5...22.exe

windows11-21h2-x64

7

54 45 53 5...ns.txt

windows10-2004-x64

1

54 45 53 5...ns.txt

windows11-21h2-x64

3

54 45 53 5...86.exe

windows10-2004-x64

7

54 45 53 5...86.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    136s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-12-2024 23:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54 45 53 54/jdk-8u191-windows-i586.exe

  • Size

    197.3MB

  • MD5

    50cfd28a3a3243bc5e9be096a3b9fd97

  • SHA1

    bc8f26edb5d1b6d93459405da76bc52c9b882e69

  • SHA256

    a92fce986622e9846b93e396a7eda6214e7f7ea90860794c934f423c10813622

  • SHA512

    859e7cc427a5ea990dd3b5301d0bb68aceac9b32f62363d5d21ed90ad45a7a7912d201dc276786bfcfb18a8683776623c7b78c4ad06c4f8002033bfaa6e8855e

  • SSDEEP

    6291456:TRcAp+FfSMhbAOo8ZycQv15tZ8YpG+sdjjceHAk8iaKmh:TRcAp4SWAURo5MAHojjjHEiaT

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 40 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\54 45 53 54\jdk-8u191-windows-i586.exe
    "C:\Users\Admin\AppData\Local\Temp\54 45 53 54\jdk-8u191-windows-i586.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\jds240637109.tmp\jdk-8u191-windows-i586.exe
      "C:\Users\Admin\AppData\Local\Temp\jds240637109.tmp\jdk-8u191-windows-i586.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi" WRAPPER=1
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4152
        • C:\Program Files (x86)\Java\jdk1.8.0_191\jre.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\\jre.exe" LAUNCHEDFROMJDK=1 NOSTARTMENU=0
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F0ABC4F133F752B759BBDFA543394FA0 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2516
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2992
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0D6D7136149D5DCDEA8ADD34F237E363
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4468
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 183A443988A43B5DC2D5347574859E08 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1372
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1428
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:576
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2364
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3864
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4824
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3852
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3300
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4132
      • C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\javaw.exe
        "C:\Program Files (x86)\Java\jdk1.8.0_191\\jre\bin\javaw.exe" -Xshare:dump
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1592
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e584562.rbs
      Filesize

      11KB

      MD5

      da627cb7f8b084bfff67a934324adf03

      SHA1

      cb4fc3f829cd27fc239617d18d1a458c3f83c8b1

      SHA256

      1122fb0e941c0f7c78298c983d5b697332152cccaa4a29fc3bd1b2ee41733eee

      SHA512

      625a2e42da2b10348787bd90fee8e90100d89dd9bcf1bca7cca0494d8a579152691a4ce3ffd9db944b4eb2a6787ac2a42d2282daf53ae1393c0ffb508b23e81a

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
      Filesize

      12KB

      MD5

      b35adb5213ca9657e911e9befb180842

      SHA1

      8d80da0c92c1269b610b03cc8061556004898c85

      SHA256

      9a96d0daf98aa6fb4aa530d399c742c66121b0bdae4a1f7ffa22d2135e1df7fd

      SHA512

      82112691ba9b49c3e335e7eb7a426f5d24072c72424612b0d07863560fd37042b6408317db9bd973280eb17e100ec25d3ce18cc6eeedc57c27d338fa517ea6fa

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
      Filesize

      8KB

      MD5

      1fabf1d6edd14f933014d5557c7b7522

      SHA1

      67958aa114880c281036cc14a4e53fa123c4d9ad

      SHA256

      5f7d79ccbca7bdd2d9e036984a8a60c6bb9051411a740dc538f36f882f983b6e

      SHA512

      4c4f2caafc7ea9e97303f31c6f6a192a64fea4f24cc9d071b8339a519c1ea7f951e14571c9e9a23eee140fb676c7b213dc25828b274639046d9e01f6cd85dd3b

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
      Filesize

      57B

      MD5

      adf99b54fd6f317b611320564167c305

      SHA1

      d3d80dd39b686e04bf31db6ac9335084e841ef73

      SHA256

      1b68454d53e781f8793547fde8fcb2f3b03b5c8134f37b9d8c4045cb8a5473f3

      SHA512

      65fb44cdaf01632d60ecf3b49ab1eb661982ee8b6a430dcf6d1e75789787c9e7356754cd071421ca44a1b32ab918be97a630b1b0ca722383eea56d40fa131642

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
      Filesize

      7KB

      MD5

      36f381cc8f60a659777f1133a006de4f

      SHA1

      b70e38fecb27a4de0776951a919bf072e601690e

      SHA256

      a3f56fee6bf824076f7599298272225f054dabac6a45b517eedfedc1f37d3c16

      SHA512

      dc1afd3b53c97c090c3baae27ef50531b27ce72509fbe2d3d4e53b99bcf7d555d13a7545a072c518e446bc433c2cf14300bb149e784a1db841ef9c3f3dd0efae

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
      Filesize

      834B

      MD5

      543ff9c4bb3fd6f4d35c0a80ba5533fc

      SHA1

      e318b6209faeffe8cde2dba71f226d2b161729af

      SHA256

      40c04d540c3d7d80564f34af3a512036bdd8e17b4ca74ba3b7e45d6d93466bcd

      SHA512

      6257994ac1ec8b99edcf0d666838a9874031a500adac9383d9b4242edc6c6ffec48f230740d443c1088aa911a36de26e7ce3b97313e3d36b00aede5352a8cf5a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5
      Filesize

      5B

      MD5

      5bfa51f3a417b98e7443eca90fc94703

      SHA1

      8c015d80b8a23f780bdd215dc842b0f5551f63bd

      SHA256

      bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

      SHA512

      4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECF3006D44DA211141391220EE5049F4
      Filesize

      92KB

      MD5

      2490403d578f1880648f8e05e241af81

      SHA1

      219c02c8ec14dd11e6e7d81f02c9523ffe023445

      SHA256

      40b069b9339d6a36925ec3d1af079b634d90e9c607040edff1959fa49c0ec29c

      SHA512

      01a8324f89004818bc978a9fa1d040ed0b8be757e41b4fe5d52bc14b84927ae8723413a09513391c93d7ec2ec0b8c8d6966ea608a640e3647856788b58e649df

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
      Filesize

      180B

      MD5

      1d53daa16c95c598cf19abda81be53f8

      SHA1

      897e02f0968c3f7403f49a371559a7a51130a619

      SHA256

      b5d3cf44591eab67790e002f5cc1b7ae7a43efcb433c2c28e3bcc73652b9cb51

      SHA512

      73b994f5fa20e6f2890203b74f1b900075ea8de3a7c622d72d517d07a01eb38e96a8be218e1528e237f9b285aba84adeccac03136f5fdf6fb79ecce232bb54fd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
      Filesize

      398B

      MD5

      6f3f84bee7bc88f0e5245871a9efd3ff

      SHA1

      2abf058a1f3a3a129d7cc586df01aa0d63228d8d

      SHA256

      92d1ec3b2d8f54e147c4e323e2c67eabd387b3e749e61acf03d37147721ac61c

      SHA512

      8c1966ca4b11911c64c20cb4f5d1eb42d9e0789d5d7c2cb1948b0c89ba6e8c9d268bd33e81b8fa50392350fc03508b4827e23f169cab577a3d1fcc54ac1bcc5c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5
      Filesize

      402B

      MD5

      6c679e6de9ba4c0a9ecf5a390f7e038a

      SHA1

      47c3b2c57f475d0bf5f9dbfff38f96c2caf9a9d4

      SHA256

      59bd96638b3d88e2e104bebf5a20c101304e17f0fd5a863f5bc5882e555bf3e2

      SHA512

      a8c728f1f4160fedf6a09b1bea5be05f19b6fa80f5c69bd585d2fb6fe3556d535fad74fd51e231b95fddeb4f0d2cb6681b412ac5e3ad2eb1dc09d39c88575a90

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4
      Filesize

      170B

      MD5

      875eedc2305e510ffac8c842bbba6efe

      SHA1

      5929dd555326d8c06406354387920adc91fe27b4

      SHA256

      2ca0d10b1b510f9c94e2b41e79c196466bdbea7b2dc9d87f9b73924f841248a8

      SHA512

      36f3136b37da9807531369517ac465772a14469b85823bd38ce639fa4772d5d6fd800ef6d2d063a712a8b207d1d6ee02c887bdfafce2335a8fd8e225edaf3239

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi
      Filesize

      948KB

      MD5

      84f5b7ada4e0c06a2aae07a8419c9f64

      SHA1

      ed8e9b61e4967b0608406f1255e3e2dbfee3cf0b

      SHA256

      530f769f400f371383aa1ffaab30b46791a3bb5ea8e9304e3efe9ef419a7faa0

      SHA512

      84a341cd6ad2e6b560f40792042e60d4d68cdc5cfefee7a85f28a55077aa872dcaa16e27b4a95bb7fe2516a4fe3b0e714c746b69cb826b5bddef8a659fcde38c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\ss180191.cab
      Filesize

      18.8MB

      MD5

      13b35ab0d36be2f7c0f82de8beda0478

      SHA1

      04768f9d3affc6150bae2f6020072439cff65fe6

      SHA256

      6ddf1feb791d0bcdedd835713f96e0f40bf69c49e2632c40a56696ee0618b2d9

      SHA512

      54cf32cd5bf049cc24996b2f99dd27f0a349327f82ea669c673911d1697ca49a99bf099e9d7eb1089921a13ecc17dd8b6f8f136c452d0515d15a510815bfd6a0

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\sz180191.cab
      Filesize

      1KB

      MD5

      6ddd9f7229af91f72510332059768b7f

      SHA1

      2ca8b4863afc1d44352b35601dbfa652838baed2

      SHA256

      3a8f0955ee74c76f0879bcc3eb2c56c573c59a37be1e725846858ecf6ae455ac

      SHA512

      4351a88404f80cbb197dda565a27ea8e8e1d9a206207ff6469f1768080c5f8a00067488733f6470c028e6f15b9158ec47bc3052e1cab77ae7a8dc5358acaccd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSIE639.tmp
      Filesize

      565KB

      MD5

      4ca39f5a1af6d35e41170e8c30a8391e

      SHA1

      0ba37cf6d207c5401fc24687ae35fd6c93f10b79

      SHA256

      32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

      SHA512

      a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      173KB

      MD5

      ec3712a5b8bd03b55d7f78f369a58630

      SHA1

      1bfead59e6a15d39dbe76b7f34cdb9708f06977a

      SHA256

      ab3ee935ef87b08465072a5c045ff879d8879ef16dbbcc490d9d8b5a4292f131

      SHA512

      6f6602fadbe46ff23fd66afe6969a1c252444236bf53e25d5e992e5ff5c78ad5134ebaff83b3abb9d74f95596d0ffb52dec714058dbdf8e2deacaaac2599e0e5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      172KB

      MD5

      49d3b9a8dbbd77e6c6ed1720923b99fa

      SHA1

      30be5057c668df7432b86903279bbdc3bf7ab289

      SHA256

      8a006209ae1e005bc5de0b6404cc6b77f528c9ddfacbca5cd066539a10465243

      SHA512

      20282a02efa75cfea62e315c8c55dbbee1b8db07c34038b317513f018056670219fe8aa9f5b2e04228359495e353513ed91668a7ecd5621213829cc2e4f1af63

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      164KB

      MD5

      cd7f6d4de8656de12e03070fc9a5e4ef

      SHA1

      98164219ab0754cacf2dd3bcafe1f97532af0edf

      SHA256

      9b9c6574db2a609c31a25ab80e5a7d087903e327ae4b70d1e4139ee905735ca3

      SHA512

      885e30939ed4022ef1d85d07b2760f1c76a9035c52253fb73c21942cbd86ac155d39c3ac709d72db240bc13709419e0df2e21036582cd0712028a27cea735123

      Download Submit

    • memory/1592-1904-0x0000000001570000-0x0000000001571000-memory.dmp

      Filesize

      4KB

      Download