Overview

overview

10

Static

static

10

__06_.jar.msi

windows7_x64

6

__06_.jar.msi

windows10_x64

8

Analysis

  • max time kernel
    107s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09/11/2020, 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    __06_.jar.msi

  • Size

    382KB

  • MD5

    13a4072d8d0eba59712bb4ec251e0593

  • SHA1

    860bf56ba3537c6673674499431ecdcda60dc8c2

  • SHA256

    04a3cad80470a085b6ef57a7e1007049a29863a94fe76f93be1f2a0c54da99d6

  • SHA512

    abe9aff533d38d60cf540872e0a40366e0b61cb1c76e1c9515a5a0fc54c3579f95cfd77ca8bbb5d2d6a05ceeb1996029b087acb648241702cfb550c71fca0cfe

Score
6/10
persistence

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 149 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Modifies data under HKEY_USERS 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\__06_.jar.msi
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1808
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Modifies service
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1624
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:852
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005B8" "00000000000005BC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1624-6-0x0000000001800000-0x0000000001804000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1624-7-0x0000000001030000-0x0000000001034000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1624-8-0x0000000001030000-0x0000000001034000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1808-0-0x00000000040B0000-0x00000000040B4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1808-1-0x00000000051E0000-0x00000000051E4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1808-2-0x0000000005330000-0x0000000005334000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1808-3-0x0000000005330000-0x0000000005334000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1808-4-0x0000000005330000-0x0000000005334000-memory.dmp

    Filesize

    16KB

    Download