Overview

overview

7

Static

static

3

54 45 53 5...22.exe

windows10-2004-x64

7

54 45 53 5...22.exe

windows11-21h2-x64

3

54 45 53 5...86.exe

windows10-2004-x64

7

54 45 53 5...86.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-12-2024 23:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54 45 53 54/jdk-8u191-windows-i586.exe

  • Size

    197.3MB

  • MD5

    50cfd28a3a3243bc5e9be096a3b9fd97

  • SHA1

    bc8f26edb5d1b6d93459405da76bc52c9b882e69

  • SHA256

    a92fce986622e9846b93e396a7eda6214e7f7ea90860794c934f423c10813622

  • SHA512

    859e7cc427a5ea990dd3b5301d0bb68aceac9b32f62363d5d21ed90ad45a7a7912d201dc276786bfcfb18a8683776623c7b78c4ad06c4f8002033bfaa6e8855e

  • SSDEEP

    6291456:TRcAp+FfSMhbAOo8ZycQv15tZ8YpG+sdjjceHAk8iaKmh:TRcAp4SWAURo5MAHojjjHEiaT

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 40 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\54 45 53 54\jdk-8u191-windows-i586.exe
    "C:\Users\Admin\AppData\Local\Temp\54 45 53 54\jdk-8u191-windows-i586.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\jds240617406.tmp\jdk-8u191-windows-i586.exe
      "C:\Users\Admin\AppData\Local\Temp\jds240617406.tmp\jdk-8u191-windows-i586.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi" WRAPPER=1
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1848
        • C:\Program Files (x86)\Java\jdk1.8.0_191\jre.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\\jre.exe" LAUNCHEDFROMJDK=1 NOSTARTMENU=0
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1324
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 394353CDED06D29E617DA2A5C1E98268 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2704
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3148
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 24CCDB367B9B3BB84D648EEFB08A2465
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3536
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2828091029AA9121C2CBF774924DA195 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\lib/tools.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2800
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/plugin.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4032
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/javaws.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4220
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/deploy.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5104
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/rt.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3920
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/jsse.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:420
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/charsets.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1592
        • C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe
          "C:\Program Files (x86)\Java\jdk1.8.0_191\bin\unpack200.exe" -r "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.pack" "C:\Program Files (x86)\Java\jdk1.8.0_191\jre/lib/ext/localedata.jar"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2540
      • C:\Program Files (x86)\Java\jdk1.8.0_191\jre\bin\javaw.exe
        "C:\Program Files (x86)\Java\jdk1.8.0_191\\jre\bin\javaw.exe" -Xshare:dump
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3876
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57e149.rbs
      Filesize

      11KB

      MD5

      b249d51d4ef9a6468b5ca03ac87f6684

      SHA1

      cd21710e0e77ff6451aad10e416d6bbb61dfc608

      SHA256

      fd7764b21f4b1223f7c146713a589e5b2cef890bedaff51c0ec283d056a99754

      SHA512

      eb028455758df2883e2238bc0604a060ccf9695f88470f30561937b80550c2090964da60af9f5b94d1c7316e29643fcfc2d33b99581dc50d948a308f5e065855

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html
      Filesize

      12KB

      MD5

      b35adb5213ca9657e911e9befb180842

      SHA1

      8d80da0c92c1269b610b03cc8061556004898c85

      SHA256

      9a96d0daf98aa6fb4aa530d399c742c66121b0bdae4a1f7ffa22d2135e1df7fd

      SHA512

      82112691ba9b49c3e335e7eb7a426f5d24072c72424612b0d07863560fd37042b6408317db9bd973280eb17e100ec25d3ce18cc6eeedc57c27d338fa517ea6fa

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html
      Filesize

      8KB

      MD5

      1fabf1d6edd14f933014d5557c7b7522

      SHA1

      67958aa114880c281036cc14a4e53fa123c4d9ad

      SHA256

      5f7d79ccbca7bdd2d9e036984a8a60c6bb9051411a740dc538f36f882f983b6e

      SHA512

      4c4f2caafc7ea9e97303f31c6f6a192a64fea4f24cc9d071b8339a519c1ea7f951e14571c9e9a23eee140fb676c7b213dc25828b274639046d9e01f6cd85dd3b

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
      Filesize

      57B

      MD5

      adf99b54fd6f317b611320564167c305

      SHA1

      d3d80dd39b686e04bf31db6ac9335084e841ef73

      SHA256

      1b68454d53e781f8793547fde8fcb2f3b03b5c8134f37b9d8c4045cb8a5473f3

      SHA512

      65fb44cdaf01632d60ecf3b49ab1eb661982ee8b6a430dcf6d1e75789787c9e7356754cd071421ca44a1b32ab918be97a630b1b0ca722383eea56d40fa131642

      Download Submit

    • C:\Program Files (x86)\Java\jdk1.8.0_191\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
      Filesize

      7KB

      MD5

      36f381cc8f60a659777f1133a006de4f

      SHA1

      b70e38fecb27a4de0776951a919bf072e601690e

      SHA256

      a3f56fee6bf824076f7599298272225f054dabac6a45b517eedfedc1f37d3c16

      SHA512

      dc1afd3b53c97c090c3baae27ef50531b27ce72509fbe2d3d4e53b99bcf7d555d13a7545a072c518e446bc433c2cf14300bb149e784a1db841ef9c3f3dd0efae

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
      Filesize

      834B

      MD5

      543ff9c4bb3fd6f4d35c0a80ba5533fc

      SHA1

      e318b6209faeffe8cde2dba71f226d2b161729af

      SHA256

      40c04d540c3d7d80564f34af3a512036bdd8e17b4ca74ba3b7e45d6d93466bcd

      SHA512

      6257994ac1ec8b99edcf0d666838a9874031a500adac9383d9b4242edc6c6ffec48f230740d443c1088aa911a36de26e7ce3b97313e3d36b00aede5352a8cf5a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
      Filesize

      5B

      MD5

      5bfa51f3a417b98e7443eca90fc94703

      SHA1

      8c015d80b8a23f780bdd215dc842b0f5551f63bd

      SHA256

      bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

      SHA512

      4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ECF3006D44DA211141391220EE5049F4
      Filesize

      92KB

      MD5

      2490403d578f1880648f8e05e241af81

      SHA1

      219c02c8ec14dd11e6e7d81f02c9523ffe023445

      SHA256

      40b069b9339d6a36925ec3d1af079b634d90e9c607040edff1959fa49c0ec29c

      SHA512

      01a8324f89004818bc978a9fa1d040ed0b8be757e41b4fe5d52bc14b84927ae8723413a09513391c93d7ec2ec0b8c8d6966ea608a640e3647856788b58e649df

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
      Filesize

      180B

      MD5

      6b7d01b1963dc0cd3a8d65fc31640247

      SHA1

      a36d386b98746d59a7122a17707353fe5807caca

      SHA256

      1e4d28a852ed654f8a634545ca23f04de52883d69d99f2673e7ad3c5ca218d58

      SHA512

      60bdbcd5797bfdf3918765e1a01ba4605cb1c8442f5fff0a239d21ecbca5aeb00438005f2de927524b66f88a8f519f76f3ff372450008746e7309a86e0d652ff

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE
      Filesize

      398B

      MD5

      48b837c59c3a5e73c6535d928dc3a08d

      SHA1

      678de01fe24c8300ee2bb7da2f79c4419b9062c6

      SHA256

      56d59015a7771e09982ebdc03beb8dd9e34dd20d66b35a99267537fe4b75898b

      SHA512

      9ede3db0abea2b079135bf426e83b28a47a94a4b56c02650e9a405ae951b9a949f05b595b23c5ac3be3b7b2be8c9ebeee97b4a1c5aa3c5ed644dc146dd985b3b

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_1958C8FC5F0E0F8549703D0A9B9309B5
      Filesize

      402B

      MD5

      93133aea051fc1dd5dc2166df4bb1e14

      SHA1

      19bdf6b122530c309f39f8321eb844a7eea41938

      SHA256

      c1e0f0aba1694d96fb4815120371224f8dc0a9b2e05d94acea87c48584fe7fdb

      SHA512

      8b0251a64788d4a750ccedefdb5ede4d8050aad8802508eb03c44284bfa30c67c387746775ee7a153d45c13990db35f9d1445729d5d54a59c77fca785406b079

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ECF3006D44DA211141391220EE5049F4
      Filesize

      170B

      MD5

      0d734a5b31e32c243fd4176d2eb45ba6

      SHA1

      8ef67ae345d69fe57fee4d65aed0b38b5262c0e6

      SHA256

      6b51d134305330112bbfa64e2cd04747efb0015ad40831c17a66c9db392fca6a

      SHA512

      1e60b0ad1d011d001eee6ba03342bf57435bc5f8c86ad2a2ca82981df2c9abf6e3f4f885ad51c8ee009d893b20ac2c9d62e6a4bd677dabafb697d23a03f4213d

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi
      Filesize

      948KB

      MD5

      84f5b7ada4e0c06a2aae07a8419c9f64

      SHA1

      ed8e9b61e4967b0608406f1255e3e2dbfee3cf0b

      SHA256

      530f769f400f371383aa1ffaab30b46791a3bb5ea8e9304e3efe9ef419a7faa0

      SHA512

      84a341cd6ad2e6b560f40792042e60d4d68cdc5cfefee7a85f28a55077aa872dcaa16e27b4a95bb7fe2516a4fe3b0e714c746b69cb826b5bddef8a659fcde38c

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\ss180191.cab
      Filesize

      18.8MB

      MD5

      13b35ab0d36be2f7c0f82de8beda0478

      SHA1

      04768f9d3affc6150bae2f6020072439cff65fe6

      SHA256

      6ddf1feb791d0bcdedd835713f96e0f40bf69c49e2632c40a56696ee0618b2d9

      SHA512

      54cf32cd5bf049cc24996b2f99dd27f0a349327f82ea669c673911d1697ca49a99bf099e9d7eb1089921a13ecc17dd8b6f8f136c452d0515d15a510815bfd6a0

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\sz180191.cab
      Filesize

      1KB

      MD5

      6ddd9f7229af91f72510332059768b7f

      SHA1

      2ca8b4863afc1d44352b35601dbfa652838baed2

      SHA256

      3a8f0955ee74c76f0879bcc3eb2c56c573c59a37be1e725846858ecf6ae455ac

      SHA512

      4351a88404f80cbb197dda565a27ea8e8e1d9a206207ff6469f1768080c5f8a00067488733f6470c028e6f15b9158ec47bc3052e1cab77ae7a8dc5358acaccd9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSI98D5.tmp
      Filesize

      565KB

      MD5

      4ca39f5a1af6d35e41170e8c30a8391e

      SHA1

      0ba37cf6d207c5401fc24687ae35fd6c93f10b79

      SHA256

      32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

      SHA512

      a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      164KB

      MD5

      8526786f63f614f7a2919cb0a52487b9

      SHA1

      92fe506231b0017d04f9605f0cd178ee32fd3391

      SHA256

      3f64d9690425845e0eca5e3fe1fd14db571680ff50cdb71097dff7aa327448cd

      SHA512

      6c4eead6369600cf7300a46dd1c4a97e1627db330ef710e550188e37c127ecae5f4bde7c4f9b72fac84ca081304bb42e82e9372a05de43bf69d154936ce2a919

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      173KB

      MD5

      64538c99a5312405cb0c6ee7ff34b263

      SHA1

      e830cbe788938758bf6b6da46340571e448068b4

      SHA256

      ab9589a77a89bf0996660ed09e042cbb65b01819049e65b055b1fe3b0c959c12

      SHA512

      f54bea5e388dbb3112895e1895366ed7f4d01753580b603f7dcec8fee74ca1e890a5e2cfb877ff4f3d8f44576b41be7b1e0f23f20c61a026a4775b4ba1fd7c65

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\jusched.log
      Filesize

      172KB

      MD5

      87d82ab7ce0808308caf51fbc7031f1d

      SHA1

      ec38114a70296c93562217933f703eb659732368

      SHA256

      7eb31fb9efbc852555f531c6e0952b3cd2802651b528b0b788bd797f657fc7af

      SHA512

      7547101274f52d1d05e4de2369fc1063760a0aa752e34b7041409159e347a03bc9c06a54d77fa4710df935a4b94ee5e1236539c9d70f3ea10caa6a1572fbf984

      Download Submit

    • memory/3876-1904-0x0000000002660000-0x0000000002661000-memory.dmp

      Filesize

      4KB

      Download