52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be

Analysis

max time kernel
94s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe
Size 1.7MB
Sample250119-v4j2ssymfl
SHA256 52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be
MD5 595021b7168f4b969616b6cd14dd189d
SHA1 dde1ea27dd125eb5a1ee80793b83da561b09b230
SHA512 5ff42e25b43a1ae974ccf10dcb30dd1985dac857f58d12147bdbaf6c255213422b02a0b8c8431886a22b78be886c3d232aad7310c0c4d64d2faf5d6c9dd1f9ab
SSDEEP 49152:mKxNuLkTcKb4rSUfkVFjLaB0zj0yjoB2:/fuLkT5NUQQB2Yyjl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4968	javaws.exe
4968	javaws.exe
3472	jp2launcher.exe
3472	jp2launcher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3472	jp2launcher.exe
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe
5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4968	5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe	83
PID 5020 wrote to memory of 4968	5020	52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe	83
PID 4968 wrote to memory of 3472	4968	javaws.exe	84
PID 4968 wrote to memory of 3472	4968	javaws.exe	84

C:\Users\Admin\AppData\Local\Temp\52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe
"C:\Users\Admin\AppData\Local\Temp\52ea74b57d60f18772acccff9e919e96175fcd547ee8b59e413f25848c5cd9be.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files\Java\jre-1.8\bin\javaws.exe
  "C:\Program Files\Java\jre-1.8\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
    "C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre-1.8" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZS0xLjhcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlLTEuOFxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUtMS44XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deployment.properties

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\deployment.properties
Size 896B
SHA256 533b7399b39909889f0d964dcbbc75b945e431a9302b7af89ecefb4cb40a2b3d
MD5 68f5179c12bfa02b15e7af01f12bc298
SHA1 387abd7be99982b209c045f0b16fdffe2f1a2862
SHA512 9f56de35ccdd7030c73f9129cd4eca4947df0f22372158e3559542ff5b1d65be53d6f02546644e2316e8354df2000c727fd2ddd33fe557386543f3a80eac1e60
MD5 SHA1 SHA512

Submit Download

securitypack.jar

Path C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\security\securitypack.jar
Size 12KB
SHA256 9771364d53fa9b1bd14cef7e48be1f5df23b11aac9f5cb6763a4934b3190e126
MD5 a66e19c05f3e0b24ac077a37c2b7589e
SHA1 8b9ad1517985c48c0bd11670fabd3648bac9d1ff
SHA512 0876a0072ac19f03818a2e5d77cec638470a09e40cd3794d901f1625c3f701f7b37a5cc6e23057a53e62d6e936f5c90bdd4a2c811c64dcfaa20dca5fdf63565f
SSDEEP 192:xZhyXGXQgyCawxbZzeSdF17Jdf+0Kf8doa+gW13jCbSnYCBoTN3DVjD5IKBsOCBE:gW59aEbdeM1Hf+ox2mbjC2NJ35bBs5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 8698657213a4463d376fb0e0b98a681130908d471cb5387607663542cecc1fdc
MD5 a722bcb6efb87599e69f2120616a542d
SHA1 d409d0f80713484201eaca7c253d4c4e4ba18f2c
SHA512 1a291f6348f45734fc316f727c00b9d264c7c942cc9bf5fd4a452306f78e60d789abd3dea0e5274a83a847febaa2d54d2bda6ecffa5d933159760434247469c1
SSDEEP 3072:u4BBWrDxXsuN8H+hIqFZk7MWDXBGGgfFLSE9D1eb8VuVlToKd:cJ8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3472-24-0x000002C98D9A0000-0x000002C98DC10000-memory.dmp

Download

memory/3472-238-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-280-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-313-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-323-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-347-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-368-0x000002C98D5A0000-0x000002C98D5A1000-memory.dmp

Download

memory/3472-369-0x000002C98D9A0000-0x000002C98DC10000-memory.dmp

Download

memory/5020-0-0x0000000000400000-0x00000000005BB000-memory.dmp

Download

memory/5020-370-0x0000000000400000-0x00000000005BB000-memory.dmp

Download