Analysis
-
max time kernel
133s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 09:58
Static task
static1
Behavioral task
behavioral1
Sample
Rechnung.jar
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Rechnung.jar
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Rechnung.jar
-
Size
471KB
-
MD5
7b5063e05d789c177bc24c844da2a4a1
-
SHA1
a853bbe2cb746312633083366b3be77962836bab
-
SHA256
a0278b5e2100e3858522804b7bd6a13518f0978e8d8758e016bf139f1a8f379d
-
SHA512
535568aa7905f0b2775266864f2fec6d4a39498417d77f3f56a3592153ee428fc77236f8fc0e025bac6701ee16b5f074ee883ba86ace166b5da41cfc55ecc3b6
Score
7/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\frbJt\Desktop.ini java.exe File created C:\Users\Admin\frbJt\Desktop.ini java.exe File opened for modification C:\Users\Admin\frbJt\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\frbJt\Desktop.ini attrib.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\RrmOk java.exe File created C:\Windows\System32\RrmOk java.exe -
Views/modifies file attributes 1 TTPs 8 IoCs
pid Process 3848 attrib.exe 1140 attrib.exe 1232 attrib.exe 3736 attrib.exe 4020 attrib.exe 1648 attrib.exe 3216 attrib.exe 812 attrib.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3812 java.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3812 wrote to memory of 4016 3812 java.exe 72 PID 3812 wrote to memory of 4016 3812 java.exe 72 PID 3812 wrote to memory of 4024 3812 java.exe 74 PID 3812 wrote to memory of 4024 3812 java.exe 74 PID 4024 wrote to memory of 3860 4024 cmd.exe 76 PID 4024 wrote to memory of 3860 4024 cmd.exe 76 PID 3812 wrote to memory of 3316 3812 java.exe 77 PID 3812 wrote to memory of 3316 3812 java.exe 77 PID 3316 wrote to memory of 3364 3316 cmd.exe 79 PID 3316 wrote to memory of 3364 3316 cmd.exe 79 PID 3812 wrote to memory of 3216 3812 java.exe 80 PID 3812 wrote to memory of 3216 3812 java.exe 80 PID 3812 wrote to memory of 812 3812 java.exe 82 PID 3812 wrote to memory of 812 3812 java.exe 82 PID 3812 wrote to memory of 3848 3812 java.exe 85 PID 3812 wrote to memory of 3848 3812 java.exe 85 PID 3812 wrote to memory of 1140 3812 java.exe 86 PID 3812 wrote to memory of 1140 3812 java.exe 86 PID 3812 wrote to memory of 1232 3812 java.exe 88 PID 3812 wrote to memory of 1232 3812 java.exe 88 PID 3812 wrote to memory of 3736 3812 java.exe 90 PID 3812 wrote to memory of 3736 3812 java.exe 90 PID 3812 wrote to memory of 4020 3812 java.exe 92 PID 3812 wrote to memory of 4020 3812 java.exe 92 PID 3812 wrote to memory of 1648 3812 java.exe 95 PID 3812 wrote to memory of 1648 3812 java.exe 95 PID 3812 wrote to memory of 2456 3812 java.exe 97 PID 3812 wrote to memory of 2456 3812 java.exe 97 PID 2456 wrote to memory of 1552 2456 cmd.exe 99 PID 2456 wrote to memory of 1552 2456 cmd.exe 99 -
Suspicious use of AdjustPrivilegeToken 126 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3860 WMIC.exe Token: SeSecurityPrivilege 3860 WMIC.exe Token: SeTakeOwnershipPrivilege 3860 WMIC.exe Token: SeLoadDriverPrivilege 3860 WMIC.exe Token: SeSystemProfilePrivilege 3860 WMIC.exe Token: SeSystemtimePrivilege 3860 WMIC.exe Token: SeProfSingleProcessPrivilege 3860 WMIC.exe Token: SeIncBasePriorityPrivilege 3860 WMIC.exe Token: SeCreatePagefilePrivilege 3860 WMIC.exe Token: SeBackupPrivilege 3860 WMIC.exe Token: SeRestorePrivilege 3860 WMIC.exe Token: SeShutdownPrivilege 3860 WMIC.exe Token: SeDebugPrivilege 3860 WMIC.exe Token: SeSystemEnvironmentPrivilege 3860 WMIC.exe Token: SeRemoteShutdownPrivilege 3860 WMIC.exe Token: SeUndockPrivilege 3860 WMIC.exe Token: SeManageVolumePrivilege 3860 WMIC.exe Token: 33 3860 WMIC.exe Token: 34 3860 WMIC.exe Token: 35 3860 WMIC.exe Token: 36 3860 WMIC.exe Token: SeIncreaseQuotaPrivilege 3860 WMIC.exe Token: SeSecurityPrivilege 3860 WMIC.exe Token: SeTakeOwnershipPrivilege 3860 WMIC.exe Token: SeLoadDriverPrivilege 3860 WMIC.exe Token: SeSystemProfilePrivilege 3860 WMIC.exe Token: SeSystemtimePrivilege 3860 WMIC.exe Token: SeProfSingleProcessPrivilege 3860 WMIC.exe Token: SeIncBasePriorityPrivilege 3860 WMIC.exe Token: SeCreatePagefilePrivilege 3860 WMIC.exe Token: SeBackupPrivilege 3860 WMIC.exe Token: SeRestorePrivilege 3860 WMIC.exe Token: SeShutdownPrivilege 3860 WMIC.exe Token: SeDebugPrivilege 3860 WMIC.exe Token: SeSystemEnvironmentPrivilege 3860 WMIC.exe Token: SeRemoteShutdownPrivilege 3860 WMIC.exe Token: SeUndockPrivilege 3860 WMIC.exe Token: SeManageVolumePrivilege 3860 WMIC.exe Token: 33 3860 WMIC.exe Token: 34 3860 WMIC.exe Token: 35 3860 WMIC.exe Token: 36 3860 WMIC.exe Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeIncreaseQuotaPrivilege 3364 WMIC.exe Token: SeSecurityPrivilege 3364 WMIC.exe Token: SeTakeOwnershipPrivilege 3364 WMIC.exe Token: SeLoadDriverPrivilege 3364 WMIC.exe Token: SeSystemProfilePrivilege 3364 WMIC.exe Token: SeSystemtimePrivilege 3364 WMIC.exe Token: SeProfSingleProcessPrivilege 3364 WMIC.exe Token: SeIncBasePriorityPrivilege 3364 WMIC.exe Token: SeCreatePagefilePrivilege 3364 WMIC.exe Token: SeBackupPrivilege 3364 WMIC.exe Token: SeRestorePrivilege 3364 WMIC.exe Token: SeShutdownPrivilege 3364 WMIC.exe Token: SeDebugPrivilege 3364 WMIC.exe Token: SeSystemEnvironmentPrivilege 3364 WMIC.exe Token: SeRemoteShutdownPrivilege 3364 WMIC.exe Token: SeUndockPrivilege 3364 WMIC.exe Token: SeManageVolumePrivilege 3364 WMIC.exe Token: 33 3364 WMIC.exe Token: 34 3364 WMIC.exe Token: 35 3364 WMIC.exe Token: 36 3364 WMIC.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: 36 1552 WMIC.exe Token: SeIncreaseQuotaPrivilege 1552 WMIC.exe Token: SeSecurityPrivilege 1552 WMIC.exe Token: SeTakeOwnershipPrivilege 1552 WMIC.exe Token: SeLoadDriverPrivilege 1552 WMIC.exe Token: SeSystemProfilePrivilege 1552 WMIC.exe Token: SeSystemtimePrivilege 1552 WMIC.exe Token: SeProfSingleProcessPrivilege 1552 WMIC.exe Token: SeIncBasePriorityPrivilege 1552 WMIC.exe Token: SeCreatePagefilePrivilege 1552 WMIC.exe Token: SeBackupPrivilege 1552 WMIC.exe Token: SeRestorePrivilege 1552 WMIC.exe Token: SeShutdownPrivilege 1552 WMIC.exe Token: SeDebugPrivilege 1552 WMIC.exe Token: SeSystemEnvironmentPrivilege 1552 WMIC.exe Token: SeRemoteShutdownPrivilege 1552 WMIC.exe Token: SeUndockPrivilege 1552 WMIC.exe Token: SeManageVolumePrivilege 1552 WMIC.exe Token: 33 1552 WMIC.exe Token: 34 1552 WMIC.exe Token: 35 1552 WMIC.exe Token: 36 1552 WMIC.exe -
Loads dropped DLL 1 IoCs
pid Process 3812 java.exe -
Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\fArJcai = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\frbJt\\ZeKFA.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run java.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\fArJcai = "\"C:\\Users\\Admin\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\frbJt\\ZeKFA.class\"" java.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce java.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Rechnung.jar1⤵
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Adds Run entry to start application
PID:3812 -
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵PID:4016
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\Oracle2⤵
- Views/modifies file attributes
PID:3216
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +r +s C:\Users\Admin\.ntusernt.ini2⤵
- Views/modifies file attributes
PID:812
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\frbJt\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:3848
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\frbJt\Desktop.ini2⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:1140
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -s -r C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:1232
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +s +r C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:3736
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h C:\Users\Admin\frbJt2⤵
- Views/modifies file attributes
PID:4020
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s +r C:\Users\Admin\frbJt\ZeKFA.class2⤵
- Views/modifies file attributes
PID:1648
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List3⤵PID:1552
-
-