Analysis
- max time kernel
146s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
Pago 31 Mar 2021 at 2.15PP3343PDF.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Pago 31 Mar 2021 at 2.15PP3343PDF.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Pago 31 Mar 2021 at 2.15PP3343PDF.jar
- Size 100KB
- Sample210331-psygly9kba
- SHA256 1cfba0ba32dbe3bb0b14a95da032d6cda94eaa5c65135973eea16d12e07e5b58
- MD5 efff05f2e8302a3801b7b4cedbcf2cba
- SHA1 234c8984e545d77ac64c30898ca3d6bf227f24fa
- SHA512 989d3169a12afdc5af695674e7c45ae45cde59c01075c8b9927cbb2f3efc36aec1089b5c66b96b38133c5cdb5b6504b90dd7c9dd4326667ef3ea54364c6303eb
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Pago 31 Mar 2021 at 2.15PP3343PDF.jar java.exe - Loads dropped DLL 2 IoCs
pid Process 1664 java.exe 1000 java.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pago 31 Mar 2021 at 2.15PP3343PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Pago 31 Mar 2021 at 2.15PP3343PDF.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pago 31 Mar 2021 at 2.15PP3343PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Pago 31 Mar 2021 at 2.15PP3343PDF.jar\"" java.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe Token: SeSecurityPrivilege 1044 WMIC.exe Token: SeTakeOwnershipPrivilege 1044 WMIC.exe Token: SeLoadDriverPrivilege 1044 WMIC.exe Token: SeSystemProfilePrivilege 1044 WMIC.exe Token: SeSystemtimePrivilege 1044 WMIC.exe Token: SeProfSingleProcessPrivilege 1044 WMIC.exe Token: SeIncBasePriorityPrivilege 1044 WMIC.exe Token: SeCreatePagefilePrivilege 1044 WMIC.exe Token: SeBackupPrivilege 1044 WMIC.exe Token: SeRestorePrivilege 1044 WMIC.exe Token: SeShutdownPrivilege 1044 WMIC.exe Token: SeDebugPrivilege 1044 WMIC.exe Token: SeSystemEnvironmentPrivilege 1044 WMIC.exe Token: SeRemoteShutdownPrivilege 1044 WMIC.exe Token: SeUndockPrivilege 1044 WMIC.exe Token: SeManageVolumePrivilege 1044 WMIC.exe Token: 33 1044 WMIC.exe Token: 34 1044 WMIC.exe Token: 35 1044 WMIC.exe Token: SeIncreaseQuotaPrivilege 1044 WMIC.exe Token: SeSecurityPrivilege 1044 WMIC.exe Token: SeTakeOwnershipPrivilege 1044 WMIC.exe Token: SeLoadDriverPrivilege 1044 WMIC.exe Token: SeSystemProfilePrivilege 1044 WMIC.exe Token: SeSystemtimePrivilege 1044 WMIC.exe Token: SeProfSingleProcessPrivilege 1044 WMIC.exe Token: SeIncBasePriorityPrivilege 1044 WMIC.exe Token: SeCreatePagefilePrivilege 1044 WMIC.exe Token: SeBackupPrivilege 1044 WMIC.exe Token: SeRestorePrivilege 1044 WMIC.exe Token: SeShutdownPrivilege 1044 WMIC.exe Token: SeDebugPrivilege 1044 WMIC.exe Token: SeSystemEnvironmentPrivilege 1044 WMIC.exe Token: SeRemoteShutdownPrivilege 1044 WMIC.exe Token: SeUndockPrivilege 1044 WMIC.exe Token: SeManageVolumePrivilege 1044 WMIC.exe Token: 33 1044 WMIC.exe Token: 34 1044 WMIC.exe Token: 35 1044 WMIC.exe Token: SeIncreaseQuotaPrivilege 1596 WMIC.exe Token: SeSecurityPrivilege 1596 WMIC.exe Token: SeTakeOwnershipPrivilege 1596 WMIC.exe Token: SeLoadDriverPrivilege 1596 WMIC.exe Token: SeSystemProfilePrivilege 1596 WMIC.exe Token: SeSystemtimePrivilege 1596 WMIC.exe Token: SeProfSingleProcessPrivilege 1596 WMIC.exe Token: SeIncBasePriorityPrivilege 1596 WMIC.exe Token: SeCreatePagefilePrivilege 1596 WMIC.exe Token: SeBackupPrivilege 1596 WMIC.exe Token: SeRestorePrivilege 1596 WMIC.exe Token: SeShutdownPrivilege 1596 WMIC.exe Token: SeDebugPrivilege 1596 WMIC.exe Token: SeSystemEnvironmentPrivilege 1596 WMIC.exe Token: SeRemoteShutdownPrivilege 1596 WMIC.exe Token: SeUndockPrivilege 1596 WMIC.exe Token: SeManageVolumePrivilege 1596 WMIC.exe Token: 33 1596 WMIC.exe Token: 34 1596 WMIC.exe Token: 35 1596 WMIC.exe Token: SeIncreaseQuotaPrivilege 1596 WMIC.exe Token: SeSecurityPrivilege 1596 WMIC.exe Token: SeTakeOwnershipPrivilege 1596 WMIC.exe Token: SeLoadDriverPrivilege 1596 WMIC.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 384 wrote to memory of 1664 384 java.exe 30 PID 384 wrote to memory of 1664 384 java.exe 30 PID 384 wrote to memory of 1664 384 java.exe 30 PID 1664 wrote to memory of 1000 1664 java.exe 31 PID 1664 wrote to memory of 1000 1664 java.exe 31 PID 1664 wrote to memory of 1000 1664 java.exe 31 PID 1000 wrote to memory of 1536 1000 java.exe 32 PID 1000 wrote to memory of 1536 1000 java.exe 32 PID 1000 wrote to memory of 1536 1000 java.exe 32 PID 1536 wrote to memory of 1044 1536 cmd.exe 33 PID 1536 wrote to memory of 1044 1536 cmd.exe 33 PID 1536 wrote to memory of 1044 1536 cmd.exe 33 PID 1000 wrote to memory of 1544 1000 java.exe 35 PID 1000 wrote to memory of 1544 1000 java.exe 35 PID 1000 wrote to memory of 1544 1000 java.exe 35 PID 1544 wrote to memory of 1596 1544 cmd.exe 36 PID 1544 wrote to memory of 1596 1544 cmd.exe 36 PID 1544 wrote to memory of 1596 1544 cmd.exe 36 PID 1000 wrote to memory of 1980 1000 java.exe 37 PID 1000 wrote to memory of 1980 1000 java.exe 37 PID 1000 wrote to memory of 1980 1000 java.exe 37 PID 1980 wrote to memory of 1376 1980 cmd.exe 38 PID 1980 wrote to memory of 1376 1980 cmd.exe 38 PID 1980 wrote to memory of 1376 1980 cmd.exe 38 PID 1000 wrote to memory of 2016 1000 java.exe 39 PID 1000 wrote to memory of 2016 1000 java.exe 39 PID 1000 wrote to memory of 2016 1000 java.exe 39 PID 2016 wrote to memory of 2028 2016 cmd.exe 40 PID 2016 wrote to memory of 2028 2016 cmd.exe 40 PID 2016 wrote to memory of 2028 2016 cmd.exe 40
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Pago 31 Mar 2021 at 2.15PP3343PDF.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Pago 31 Mar 2021 at 2.15PP3343PDF.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Pago 31 Mar 2021 at 2.15PP3343PDF.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:1376
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:2028
-
-
-
-