Analysis
- max time kernel
149s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
DHLMar 2021 at 9.708BZ290PDF.jar
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHLMar 2021 at 9.708BZ290PDF.jar
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target DHLMar 2021 at 9.708BZ290PDF.jar
- Size 98KB
- Sample210331-tpbw7bddh6
- SHA256 080240f1973b889a1042beea9966c3d96f3737137397d98343594afa73620447
- MD5 15900ee0dbafe42bcb3aa5653c27908e
- SHA1 f343c4161df29df8bc3c4890881f17e9d801cec3
- SHA512 5f0b482ac804a18a29f3d23a1204e9ebda9939beea1af01f4f90141cf2c6810945f04efa28d3765814b8d1c159f11c3bc4fe35a1eb3519cfa8a02d0a85237afb
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DHLMar 2021 at 9.708BZ290PDF.jar java.exe - Loads dropped DLL 2 IoCs
pid Process 368 java.exe 1928 java.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\DHLMar 2021 at 9.708BZ290PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\DHLMar 2021 at 9.708BZ290PDF.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DHLMar 2021 at 9.708BZ290PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\DHLMar 2021 at 9.708BZ290PDF.jar\"" java.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1228 WMIC.exe Token: SeSecurityPrivilege 1228 WMIC.exe Token: SeTakeOwnershipPrivilege 1228 WMIC.exe Token: SeLoadDriverPrivilege 1228 WMIC.exe Token: SeSystemProfilePrivilege 1228 WMIC.exe Token: SeSystemtimePrivilege 1228 WMIC.exe Token: SeProfSingleProcessPrivilege 1228 WMIC.exe Token: SeIncBasePriorityPrivilege 1228 WMIC.exe Token: SeCreatePagefilePrivilege 1228 WMIC.exe Token: SeBackupPrivilege 1228 WMIC.exe Token: SeRestorePrivilege 1228 WMIC.exe Token: SeShutdownPrivilege 1228 WMIC.exe Token: SeDebugPrivilege 1228 WMIC.exe Token: SeSystemEnvironmentPrivilege 1228 WMIC.exe Token: SeRemoteShutdownPrivilege 1228 WMIC.exe Token: SeUndockPrivilege 1228 WMIC.exe Token: SeManageVolumePrivilege 1228 WMIC.exe Token: 33 1228 WMIC.exe Token: 34 1228 WMIC.exe Token: 35 1228 WMIC.exe Token: SeIncreaseQuotaPrivilege 1228 WMIC.exe Token: SeSecurityPrivilege 1228 WMIC.exe Token: SeTakeOwnershipPrivilege 1228 WMIC.exe Token: SeLoadDriverPrivilege 1228 WMIC.exe Token: SeSystemProfilePrivilege 1228 WMIC.exe Token: SeSystemtimePrivilege 1228 WMIC.exe Token: SeProfSingleProcessPrivilege 1228 WMIC.exe Token: SeIncBasePriorityPrivilege 1228 WMIC.exe Token: SeCreatePagefilePrivilege 1228 WMIC.exe Token: SeBackupPrivilege 1228 WMIC.exe Token: SeRestorePrivilege 1228 WMIC.exe Token: SeShutdownPrivilege 1228 WMIC.exe Token: SeDebugPrivilege 1228 WMIC.exe Token: SeSystemEnvironmentPrivilege 1228 WMIC.exe Token: SeRemoteShutdownPrivilege 1228 WMIC.exe Token: SeUndockPrivilege 1228 WMIC.exe Token: SeManageVolumePrivilege 1228 WMIC.exe Token: 33 1228 WMIC.exe Token: 34 1228 WMIC.exe Token: 35 1228 WMIC.exe Token: SeIncreaseQuotaPrivilege 1384 WMIC.exe Token: SeSecurityPrivilege 1384 WMIC.exe Token: SeTakeOwnershipPrivilege 1384 WMIC.exe Token: SeLoadDriverPrivilege 1384 WMIC.exe Token: SeSystemProfilePrivilege 1384 WMIC.exe Token: SeSystemtimePrivilege 1384 WMIC.exe Token: SeProfSingleProcessPrivilege 1384 WMIC.exe Token: SeIncBasePriorityPrivilege 1384 WMIC.exe Token: SeCreatePagefilePrivilege 1384 WMIC.exe Token: SeBackupPrivilege 1384 WMIC.exe Token: SeRestorePrivilege 1384 WMIC.exe Token: SeShutdownPrivilege 1384 WMIC.exe Token: SeDebugPrivilege 1384 WMIC.exe Token: SeSystemEnvironmentPrivilege 1384 WMIC.exe Token: SeRemoteShutdownPrivilege 1384 WMIC.exe Token: SeUndockPrivilege 1384 WMIC.exe Token: SeManageVolumePrivilege 1384 WMIC.exe Token: 33 1384 WMIC.exe Token: 34 1384 WMIC.exe Token: 35 1384 WMIC.exe Token: SeIncreaseQuotaPrivilege 1384 WMIC.exe Token: SeSecurityPrivilege 1384 WMIC.exe Token: SeTakeOwnershipPrivilege 1384 WMIC.exe Token: SeLoadDriverPrivilege 1384 WMIC.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 844 wrote to memory of 368 844 java.exe 30 PID 844 wrote to memory of 368 844 java.exe 30 PID 844 wrote to memory of 368 844 java.exe 30 PID 368 wrote to memory of 1928 368 java.exe 31 PID 368 wrote to memory of 1928 368 java.exe 31 PID 368 wrote to memory of 1928 368 java.exe 31 PID 1928 wrote to memory of 1388 1928 java.exe 32 PID 1928 wrote to memory of 1388 1928 java.exe 32 PID 1928 wrote to memory of 1388 1928 java.exe 32 PID 1388 wrote to memory of 1228 1388 cmd.exe 33 PID 1388 wrote to memory of 1228 1388 cmd.exe 33 PID 1388 wrote to memory of 1228 1388 cmd.exe 33 PID 1928 wrote to memory of 1712 1928 java.exe 35 PID 1928 wrote to memory of 1712 1928 java.exe 35 PID 1928 wrote to memory of 1712 1928 java.exe 35 PID 1712 wrote to memory of 1384 1712 cmd.exe 36 PID 1712 wrote to memory of 1384 1712 cmd.exe 36 PID 1712 wrote to memory of 1384 1712 cmd.exe 36 PID 1928 wrote to memory of 1688 1928 java.exe 37 PID 1928 wrote to memory of 1688 1928 java.exe 37 PID 1928 wrote to memory of 1688 1928 java.exe 37 PID 1688 wrote to memory of 1152 1688 cmd.exe 38 PID 1688 wrote to memory of 1152 1688 cmd.exe 38 PID 1688 wrote to memory of 1152 1688 cmd.exe 38 PID 1928 wrote to memory of 1124 1928 java.exe 39 PID 1928 wrote to memory of 1124 1928 java.exe 39 PID 1928 wrote to memory of 1124 1928 java.exe 39 PID 1124 wrote to memory of 904 1124 cmd.exe 40 PID 1124 wrote to memory of 904 1124 cmd.exe 40 PID 1124 wrote to memory of 904 1124 cmd.exe 40
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DHLMar 2021 at 9.708BZ290PDF.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\DHLMar 2021 at 9.708BZ290PDF.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\DHLMar 2021 at 9.708BZ290PDF.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1384
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:1152
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:904
-
-
-
-