Analysis
-
max time kernel
70s -
max time network
143s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 09:58
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Rechnung.jar
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Rechnung.jar
-
Size
471KB
-
MD5
7b5063e05d789c177bc24c844da2a4a1
-
SHA1
a853bbe2cb746312633083366b3be77962836bab
-
SHA256
a0278b5e2100e3858522804b7bd6a13518f0978e8d8758e016bf139f1a8f379d
-
SHA512
535568aa7905f0b2775266864f2fec6d4a39498417d77f3f56a3592153ee428fc77236f8fc0e025bac6701ee16b5f074ee883ba86ace166b5da41cfc55ecc3b6
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 900 wrote to memory of 1612 900 java.exe 25 PID 900 wrote to memory of 1612 900 java.exe 25 PID 900 wrote to memory of 1612 900 java.exe 25 PID 900 wrote to memory of 800 900 java.exe 26 PID 900 wrote to memory of 800 900 java.exe 26 PID 900 wrote to memory of 800 900 java.exe 26 PID 800 wrote to memory of 748 800 cmd.exe 27 PID 800 wrote to memory of 748 800 cmd.exe 27 PID 800 wrote to memory of 748 800 cmd.exe 27 PID 900 wrote to memory of 1056 900 java.exe 28 PID 900 wrote to memory of 1056 900 java.exe 28 PID 900 wrote to memory of 1056 900 java.exe 28 PID 1056 wrote to memory of 1044 1056 cmd.exe 29 PID 1056 wrote to memory of 1044 1056 cmd.exe 29 PID 1056 wrote to memory of 1044 1056 cmd.exe 29 PID 900 wrote to memory of 1820 900 java.exe 30 PID 900 wrote to memory of 1820 900 java.exe 30 PID 900 wrote to memory of 1820 900 java.exe 30 PID 900 wrote to memory of 1828 900 java.exe 31 PID 900 wrote to memory of 1828 900 java.exe 31 PID 900 wrote to memory of 1828 900 java.exe 31 PID 900 wrote to memory of 1836 900 java.exe 32 PID 900 wrote to memory of 1836 900 java.exe 32 PID 900 wrote to memory of 1836 900 java.exe 32 PID 900 wrote to memory of 1848 900 java.exe 33 PID 900 wrote to memory of 1848 900 java.exe 33 PID 900 wrote to memory of 1848 900 java.exe 33 PID 900 wrote to memory of 1800 900 java.exe 34 PID 900 wrote to memory of 1800 900 java.exe 34 PID 900 wrote to memory of 1800 900 java.exe 34 PID 900 wrote to memory of 1784 900 java.exe 35 PID 900 wrote to memory of 1784 900 java.exe 35 PID 900 wrote to memory of 1784 900 java.exe 35 PID 900 wrote to memory of 1808 900 java.exe 36 PID 900 wrote to memory of 1808 900 java.exe 36 PID 900 wrote to memory of 1808 900 java.exe 36 PID 900 wrote to memory of 1232 900 java.exe 37 PID 900 wrote to memory of 1232 900 java.exe 37 PID 900 wrote to memory of 1232 900 java.exe 37 PID 900 wrote to memory of 1580 900 java.exe 38 PID 900 wrote to memory of 1580 900 java.exe 38 PID 900 wrote to memory of 1580 900 java.exe 38 PID 1580 wrote to memory of 1644 1580 cmd.exe 39 PID 1580 wrote to memory of 1644 1580 cmd.exe 39 PID 1580 wrote to memory of 1644 1580 cmd.exe 39 -
Suspicious use of AdjustPrivilegeToken 120 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe Token: SeIncreaseQuotaPrivilege 748 WMIC.exe Token: SeSecurityPrivilege 748 WMIC.exe Token: SeTakeOwnershipPrivilege 748 WMIC.exe Token: SeLoadDriverPrivilege 748 WMIC.exe Token: SeSystemProfilePrivilege 748 WMIC.exe Token: SeSystemtimePrivilege 748 WMIC.exe Token: SeProfSingleProcessPrivilege 748 WMIC.exe Token: SeIncBasePriorityPrivilege 748 WMIC.exe Token: SeCreatePagefilePrivilege 748 WMIC.exe Token: SeBackupPrivilege 748 WMIC.exe Token: SeRestorePrivilege 748 WMIC.exe Token: SeShutdownPrivilege 748 WMIC.exe Token: SeDebugPrivilege 748 WMIC.exe Token: SeSystemEnvironmentPrivilege 748 WMIC.exe Token: SeRemoteShutdownPrivilege 748 WMIC.exe Token: SeUndockPrivilege 748 WMIC.exe Token: SeManageVolumePrivilege 748 WMIC.exe Token: 33 748 WMIC.exe Token: 34 748 WMIC.exe Token: 35 748 WMIC.exe Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe Token: SeSecurityPrivilege 1044 WMIC.exe Token: SeTakeOwnershipPrivilege 1044 WMIC.exe Token: SeLoadDriverPrivilege 1044 WMIC.exe Token: SeSystemProfilePrivilege 1044 WMIC.exe Token: SeSystemtimePrivilege 1044 WMIC.exe Token: SeProfSingleProcessPrivilege 1044 WMIC.exe Token: SeIncBasePriorityPrivilege 1044 WMIC.exe Token: SeCreatePagefilePrivilege 1044 WMIC.exe Token: SeBackupPrivilege 1044 WMIC.exe Token: SeRestorePrivilege 1044 WMIC.exe Token: SeShutdownPrivilege 1044 WMIC.exe Token: SeDebugPrivilege 1044 WMIC.exe Token: SeSystemEnvironmentPrivilege 1044 WMIC.exe Token: SeRemoteShutdownPrivilege 1044 WMIC.exe Token: SeUndockPrivilege 1044 WMIC.exe Token: SeManageVolumePrivilege 1044 WMIC.exe Token: 33 1044 WMIC.exe Token: 34 1044 WMIC.exe Token: 35 1044 WMIC.exe Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe Token: SeSecurityPrivilege 1044 WMIC.exe Token: SeTakeOwnershipPrivilege 1044 WMIC.exe Token: SeLoadDriverPrivilege 1044 WMIC.exe Token: SeSystemProfilePrivilege 1044 WMIC.exe Token: SeSystemtimePrivilege 1044 WMIC.exe Token: SeProfSingleProcessPrivilege 1044 WMIC.exe Token: SeIncBasePriorityPrivilege 1044 WMIC.exe Token: SeCreatePagefilePrivilege 1044 WMIC.exe Token: SeBackupPrivilege 1044 WMIC.exe Token: SeRestorePrivilege 1044 WMIC.exe Token: SeShutdownPrivilege 1044 WMIC.exe Token: SeDebugPrivilege 1044 WMIC.exe Token: SeSystemEnvironmentPrivilege 1044 WMIC.exe Token: SeRemoteShutdownPrivilege 1044 WMIC.exe Token: SeUndockPrivilege 1044 WMIC.exe Token: SeManageVolumePrivilege 1044 WMIC.exe Token: 33 1044 WMIC.exe Token: 34 1044 WMIC.exe Token: 35 1044 WMIC.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe Token: SeIncreaseQuotaPrivilege 1644 WMIC.exe Token: SeSecurityPrivilege 1644 WMIC.exe Token: SeTakeOwnershipPrivilege 1644 WMIC.exe Token: SeLoadDriverPrivilege 1644 WMIC.exe Token: SeSystemProfilePrivilege 1644 WMIC.exe Token: SeSystemtimePrivilege 1644 WMIC.exe Token: SeProfSingleProcessPrivilege 1644 WMIC.exe Token: SeIncBasePriorityPrivilege 1644 WMIC.exe Token: SeCreatePagefilePrivilege 1644 WMIC.exe Token: SeBackupPrivilege 1644 WMIC.exe Token: SeRestorePrivilege 1644 WMIC.exe Token: SeShutdownPrivilege 1644 WMIC.exe Token: SeDebugPrivilege 1644 WMIC.exe Token: SeSystemEnvironmentPrivilege 1644 WMIC.exe Token: SeRemoteShutdownPrivilege 1644 WMIC.exe Token: SeUndockPrivilege 1644 WMIC.exe Token: SeManageVolumePrivilege 1644 WMIC.exe Token: 33 1644 WMIC.exe Token: 34 1644 WMIC.exe Token: 35 1644 WMIC.exe -
Loads dropped DLL 1 IoCs
pid Process 900 java.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\ofDCT java.exe File opened for modification C:\Windows\System32\ofDCT java.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 1808 attrib.exe 1232 attrib.exe 1820 attrib.exe 1828 attrib.exe 1836 attrib.exe 1848 attrib.exe 1800 attrib.exe 1784 attrib.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fArJcai = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\frbJt\\ZeKFA.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\fArJcai = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\frbJt\\ZeKFA.class\"" java.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\frbJt\Desktop.ini java.exe File created C:\Users\Admin\frbJt\Desktop.ini java.exe File opened for modification C:\Users\Admin\frbJt\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\frbJt\Desktop.ini attrib.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 900 java.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Rechnung.jar1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops file in System32 directory
- Adds Run entry to start application
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
PID:900 -
C:\Windows\system32\cmd.execmd.exe2⤵PID:1612
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:748
-
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:1820
-
-
C:\Windows\system32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:1828
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\frbJt\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1836
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\frbJt\Desktop.ini2⤵
- Views/modifies file attributes
- Drops desktop.ini file(s)
PID:1848
-
-
C:\Windows\system32\attrib.exeattrib -s -r C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:1800
-
-
C:\Windows\system32\attrib.exeattrib +s +r C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:1784
-
-
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:1808
-
-
C:\Windows\system32\attrib.exeattrib +h +s +r C:\Users\Admin\frbJt\ZeKFA.class2⤵
- Views/modifies file attributes
PID:1232
-
-
C:\Windows\system32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:1644
-
-