399638eeb199d1bbe7158c2f6864cc96697a0079e944518c71b0874a0811a360

Analysis

max time kernel
101s
max time network
15s
platform
windows7_x64
resource
win7v20201028
submitted
19-01-2021 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Statement for T10495 - 18-01-21 15-23.jar
Size

1.0MB
MD5

861c4a96a8f31a1f21b26ef6fd58e531
SHA1

d4e3c6efd37ad7d95c642528ec28ad2c733ca42a
SHA256

399638eeb199d1bbe7158c2f6864cc96697a0079e944518c71b0874a0811a360
SHA512

388ec18a8c30be9fa39c32e2dd08934dbbb3e1003963da7aaed9e478c554742eb315ed893e4da3e7d29fbe6f89bb4f0c988dfce4aa8ee659c4fad29d7f192700

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

5xQnWoxCrRw6.exe5xQnWoxCrRw6.exe

pid process

1940 5xQnWoxCrRw6.exe
1772 5xQnWoxCrRw6.exe
Loads dropped DLL 4 IoCs

Processes:

5xQnWoxCrRw6.exeWerFault.exe

pid process

1940 5xQnWoxCrRw6.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

5xQnWoxCrRw6.exe

description pid process target process

PID 1940 set thread context of 1772 1940 5xQnWoxCrRw6.exe 5xQnWoxCrRw6.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2040 1772 WerFault.exe 5xQnWoxCrRw6.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2012 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
2040 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1832 AcroRd32.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5xQnWoxCrRw6.exe

pid process

1940 5xQnWoxCrRw6.exe
1940 5xQnWoxCrRw6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 2040 WerFault.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exeAcroRd32.exe

pid process

1684 java.exe
1832 AcroRd32.exe
1832 AcroRd32.exe
1832 AcroRd32.exe

pid	process
1940	5xQnWoxCrRw6.exe
1772	5xQnWoxCrRw6.exe

pid	process
1940	5xQnWoxCrRw6.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe

description	pid	process	target process
PID 1940 set thread context of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe

pid	pid_target	process	target process
2040	1772	WerFault.exe	5xQnWoxCrRw6.exe

pid	process
2012	schtasks.exe

pid	process
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe
2040	WerFault.exe

pid	process
1832	AcroRd32.exe

pid	process
1940	5xQnWoxCrRw6.exe
1940	5xQnWoxCrRw6.exe

description	pid	process
Token: SeDebugPrivilege	2040	WerFault.exe

pid	process
1684	java.exe
1832	AcroRd32.exe
1832	AcroRd32.exe
1832	AcroRd32.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

java.exe5xQnWoxCrRw6.exe5xQnWoxCrRw6.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 1940	1684	java.exe	5xQnWoxCrRw6.exe
PID 1684 wrote to memory of 1940	1684	java.exe	5xQnWoxCrRw6.exe
PID 1684 wrote to memory of 1940	1684	java.exe	5xQnWoxCrRw6.exe
PID 1684 wrote to memory of 1940	1684	java.exe	5xQnWoxCrRw6.exe
PID 1684 wrote to memory of 1832	1684	java.exe	AcroRd32.exe
PID 1684 wrote to memory of 1832	1684	java.exe	AcroRd32.exe
PID 1684 wrote to memory of 1832	1684	java.exe	AcroRd32.exe
PID 1684 wrote to memory of 1832	1684	java.exe	AcroRd32.exe
PID 1940 wrote to memory of 1724	1940	5xQnWoxCrRw6.exe	cmd.exe
PID 1940 wrote to memory of 1724	1940	5xQnWoxCrRw6.exe	cmd.exe
PID 1940 wrote to memory of 1724	1940	5xQnWoxCrRw6.exe	cmd.exe
PID 1940 wrote to memory of 1724	1940	5xQnWoxCrRw6.exe	cmd.exe
PID 1940 wrote to memory of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe
PID 1940 wrote to memory of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe
PID 1940 wrote to memory of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe
PID 1940 wrote to memory of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe
PID 1940 wrote to memory of 1772	1940	5xQnWoxCrRw6.exe	5xQnWoxCrRw6.exe
PID 1772 wrote to memory of 2040	1772	5xQnWoxCrRw6.exe	WerFault.exe
PID 1772 wrote to memory of 2040	1772	5xQnWoxCrRw6.exe	WerFault.exe
PID 1772 wrote to memory of 2040	1772	5xQnWoxCrRw6.exe	WerFault.exe
PID 1772 wrote to memory of 2040	1772	5xQnWoxCrRw6.exe	WerFault.exe
PID 1724 wrote to memory of 2012	1724	cmd.exe	schtasks.exe
PID 1724 wrote to memory of 2012	1724	cmd.exe	schtasks.exe
PID 1724 wrote to memory of 2012	1724	cmd.exe	schtasks.exe
PID 1724 wrote to memory of 2012	1724	cmd.exe	schtasks.exe

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Statement for T10495 - 18-01-21 15-23.jar"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\5xQnWoxCrRw6.exe
C:\Users\Admin\5xQnWoxCrRw6.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\77967863378a48ffb4b2b5aa7d1c1fc1.xml"
3⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\77967863378a48ffb4b2b5aa7d1c1fc1.xml"
4⤵
- Creates scheduled task(s)
PID:2012

C:\Users\Admin\5xQnWoxCrRw6.exe
C:\Users\Admin\5xQnWoxCrRw6.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 36
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\GtP3krY.pdf"
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1832

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
C:\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
C:\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
C:\Users\Admin\AppData\Local\Temp\77967863378a48ffb4b2b5aa7d1c1fc1.xml
MD5
a035055e1c80bc652520df45650c690f

SHA1
37b8364ad46e17199eb5a7ee89bb506bba384adb

SHA256
2b9948d34674d0fc0f9cb290da8298441b56205f6e341e3cfa1954df42c2b655

SHA512
678279d1bfc8a71c27a5a2c3afa5fd266882a62610863a3e4ebc2489f17827ed4c680c89e6b8b52621320500294d2df9888259ccdc5d38def43e739c1f325fc1

Download Submit
C:\Users\Admin\GtP3krY.pdf
MD5
05feac88a3982cd6f58520ba3efdcfab

SHA1
b65289e98c62ca821da2c2dc2446fc3cd087d4ee

SHA256
06b91869bf886c49fc0871005f9001c7e3f2819e85ec27c12e4253f3e3f548a0

SHA512
5f5e5bbbb2a31ec0c5a02bf5b112613aa5beea9e14b2dfc4b44a342dfebc0e08aeacdb28e9ec6cf6eb6e002485f77dedeb38e18fb186277a0aced0d10a419297

Download Submit
\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
\Users\Admin\5xQnWoxCrRw6.exe
MD5
ac2cd6f7e548a2c56d95c61ab77b3129

SHA1
219ff80a56397eb7dfdf3f7965ec4f129d369e71

SHA256
8a40cddf9616f75bd1fa478fab33de2a519b7feff29fd7e1d7d67809e0d5b79b

SHA512
6b2697d0d5e421749284426af2e40b04303ea9a8ada2370c25785d636fe2e81c04c26e787eaf520250125c4f665a5e663dd766fec878eb0ad1858ede759d3169

Download Submit
memory/1684-2-0x000007FEFC2C1000-0x000007FEFC2C3000-memory.dmp

Filesize
8KB

Download
memory/1684-3-0x00000000021F0000-0x0000000002460000-memory.dmp

Filesize
2.4MB

Download
memory/1724-10-0x0000000000000000-mapping.dmp

Download
memory/1772-12-0x000000000008CFF0-mapping.dmp

Download
memory/1832-7-0x0000000000000000-mapping.dmp

Download
memory/1940-6-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1940-4-0x0000000000000000-mapping.dmp

Download
memory/2012-16-0x0000000000000000-mapping.dmp

Download
memory/2040-15-0x0000000002310000-0x0000000002321000-memory.dmp

Filesize
68KB

Download
memory/2040-14-0x0000000000000000-mapping.dmp

Download
memory/2040-21-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/2040-24-0x00000000025E0000-0x00000000025F1000-memory.dmp

Filesize
68KB

Download
memory/2040-25-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads