Overview

overview

8

Static

static

1

the_watchi...on.jar

windows10-2004-x64

8

the_watchi...on.jar

windows10-ltsc 2021-x64

1

Resubmissions

02-02-2025 16:44

250202-t8tlcsslfm 8

02-02-2025 08:43

250202-kmka5atpcw 1

01-02-2025 19:11

250201-xwczmawlcv 8

01-02-2025 19:11

250201-xv2atswlaz 3

01-02-2025 19:09

250201-xtzevawkfx 3

01-02-2025 19:02

250201-xp6y5awjav 8

01-02-2025 18:52

250201-xjcs4axlek 10

01-02-2025 18:49

250201-xgd85svpav 3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    the_watching_nightmare_updated-Reborn-1.19.4 edition.jar

  • Size

    12.7MB

  • Sample

    250202-t8tlcsslfm

  • MD5

    a718c31344afb79ab44968939d06e8b7

  • SHA1

    dc7ea8bc0398e224c8a7cc13989289071483ab10

  • SHA256

    457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571

  • SHA512

    91e794b814f496ec3b27e30ab38ae2517f024548bc554e3ba607489cefc0823e30fa9ccde0f180dd772668117737fa5a957a0b0503d04edf8c76755a8e7c29ae

  • SSDEEP

    196608:UCpW79MRAwoS6RnRbyMHLXlz6pJ21/bM51ux44+J9ZJi44+pVtSxjXaOzP2O:dpWZMmr2T21DM5184zRJdAxjaA2O

Score
8/10
discoverypersistenceupx

Malware Config

Targets

    • Target

      the_watching_nightmare_updated-Reborn-1.19.4 edition.jar

    • Size

      12.7MB

    • MD5

      a718c31344afb79ab44968939d06e8b7

    • SHA1

      dc7ea8bc0398e224c8a7cc13989289071483ab10

    • SHA256

      457d62cdc267486cc5abca9fb5f8c1a66fe280830853dba0e96d853de270c571

    • SHA512

      91e794b814f496ec3b27e30ab38ae2517f024548bc554e3ba607489cefc0823e30fa9ccde0f180dd772668117737fa5a957a0b0503d04edf8c76755a8e7c29ae

    • SSDEEP

      196608:UCpW79MRAwoS6RnRbyMHLXlz6pJ21/bM51ux44+J9ZJi44+pVtSxjXaOzP2O:dpWZMmr2T21DM5184zRJdAxjaA2O

    Score
    8/10
    discoverypersistenceupx

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks