Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7v20210408 - submitted
03/05/2021, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
Annexure A-61322.jar
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Annexure A-61322.jar
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target Annexure A-61322.jar
- Size 126KB
- Sample210503-2yglcev2p2
- SHA256 ca0c5787943929cb6e8efb4403d58a9524b3afcb1bc0da075f8da333beab58bc
- MD5 86e3c52136afea5be1ccd503f0aac5a5
- SHA1 586fbbe556125735dfa8cb1fac794f71763a8c01
- SHA512 404d703e3c20d50807750d0a20db938afaf91917251237289f5adab209d500f1c91261cc19bcb8719ace60b4a7ba3ea218218c695c08e20592d23a60b2e068a3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hhvaeecsts.txt java.exe - Loads dropped DLL 2 IoCs
pid Process 1956 java.exe 1752 java.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvaeecsts = "\"C:\\Users\\Admin\\AppData\\Roaming\\hhvaeecsts.txt\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hhvaeecsts = "\"C:\\Users\\Admin\\AppData\\Roaming\\hhvaeecsts.txt\"" java.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 760 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2028 WMIC.exe Token: SeSecurityPrivilege 2028 WMIC.exe Token: SeTakeOwnershipPrivilege 2028 WMIC.exe Token: SeLoadDriverPrivilege 2028 WMIC.exe Token: SeSystemProfilePrivilege 2028 WMIC.exe Token: SeSystemtimePrivilege 2028 WMIC.exe Token: SeProfSingleProcessPrivilege 2028 WMIC.exe Token: SeIncBasePriorityPrivilege 2028 WMIC.exe Token: SeCreatePagefilePrivilege 2028 WMIC.exe Token: SeBackupPrivilege 2028 WMIC.exe Token: SeRestorePrivilege 2028 WMIC.exe Token: SeShutdownPrivilege 2028 WMIC.exe Token: SeDebugPrivilege 2028 WMIC.exe Token: SeSystemEnvironmentPrivilege 2028 WMIC.exe Token: SeRemoteShutdownPrivilege 2028 WMIC.exe Token: SeUndockPrivilege 2028 WMIC.exe Token: SeManageVolumePrivilege 2028 WMIC.exe Token: 33 2028 WMIC.exe Token: 34 2028 WMIC.exe Token: 35 2028 WMIC.exe Token: SeIncreaseQuotaPrivilege 2028 WMIC.exe Token: SeSecurityPrivilege 2028 WMIC.exe Token: SeTakeOwnershipPrivilege 2028 WMIC.exe Token: SeLoadDriverPrivilege 2028 WMIC.exe Token: SeSystemProfilePrivilege 2028 WMIC.exe Token: SeSystemtimePrivilege 2028 WMIC.exe Token: SeProfSingleProcessPrivilege 2028 WMIC.exe Token: SeIncBasePriorityPrivilege 2028 WMIC.exe Token: SeCreatePagefilePrivilege 2028 WMIC.exe Token: SeBackupPrivilege 2028 WMIC.exe Token: SeRestorePrivilege 2028 WMIC.exe Token: SeShutdownPrivilege 2028 WMIC.exe Token: SeDebugPrivilege 2028 WMIC.exe Token: SeSystemEnvironmentPrivilege 2028 WMIC.exe Token: SeRemoteShutdownPrivilege 2028 WMIC.exe Token: SeUndockPrivilege 2028 WMIC.exe Token: SeManageVolumePrivilege 2028 WMIC.exe Token: 33 2028 WMIC.exe Token: 34 2028 WMIC.exe Token: 35 2028 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe Token: SeSystemProfilePrivilege 1872 WMIC.exe Token: SeSystemtimePrivilege 1872 WMIC.exe Token: SeProfSingleProcessPrivilege 1872 WMIC.exe Token: SeIncBasePriorityPrivilege 1872 WMIC.exe Token: SeCreatePagefilePrivilege 1872 WMIC.exe Token: SeBackupPrivilege 1872 WMIC.exe Token: SeRestorePrivilege 1872 WMIC.exe Token: SeShutdownPrivilege 1872 WMIC.exe Token: SeDebugPrivilege 1872 WMIC.exe Token: SeSystemEnvironmentPrivilege 1872 WMIC.exe Token: SeRemoteShutdownPrivilege 1872 WMIC.exe Token: SeUndockPrivilege 1872 WMIC.exe Token: SeManageVolumePrivilege 1872 WMIC.exe Token: 33 1872 WMIC.exe Token: 34 1872 WMIC.exe Token: 35 1872 WMIC.exe Token: SeIncreaseQuotaPrivilege 1872 WMIC.exe Token: SeSecurityPrivilege 1872 WMIC.exe Token: SeTakeOwnershipPrivilege 1872 WMIC.exe Token: SeLoadDriverPrivilege 1872 WMIC.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1988 1652 java.exe 27 PID 1652 wrote to memory of 1988 1652 java.exe 27 PID 1652 wrote to memory of 1988 1652 java.exe 27 PID 1988 wrote to memory of 1832 1988 wscript.exe 28 PID 1988 wrote to memory of 1832 1988 wscript.exe 28 PID 1988 wrote to memory of 1832 1988 wscript.exe 28 PID 1832 wrote to memory of 1956 1832 javaw.exe 33 PID 1832 wrote to memory of 1956 1832 javaw.exe 33 PID 1832 wrote to memory of 1956 1832 javaw.exe 33 PID 1956 wrote to memory of 772 1956 java.exe 34 PID 1956 wrote to memory of 772 1956 java.exe 34 PID 1956 wrote to memory of 772 1956 java.exe 34 PID 1956 wrote to memory of 1752 1956 java.exe 35 PID 1956 wrote to memory of 1752 1956 java.exe 35 PID 1956 wrote to memory of 1752 1956 java.exe 35 PID 772 wrote to memory of 760 772 cmd.exe 38 PID 772 wrote to memory of 760 772 cmd.exe 38 PID 772 wrote to memory of 760 772 cmd.exe 38 PID 1752 wrote to memory of 1288 1752 java.exe 40 PID 1752 wrote to memory of 1288 1752 java.exe 40 PID 1752 wrote to memory of 1288 1752 java.exe 40 PID 1288 wrote to memory of 2028 1288 cmd.exe 41 PID 1288 wrote to memory of 2028 1288 cmd.exe 41 PID 1288 wrote to memory of 2028 1288 cmd.exe 41 PID 1752 wrote to memory of 1212 1752 java.exe 45 PID 1752 wrote to memory of 1212 1752 java.exe 45 PID 1752 wrote to memory of 1212 1752 java.exe 45 PID 1212 wrote to memory of 1872 1212 cmd.exe 43 PID 1212 wrote to memory of 1872 1212 cmd.exe 43 PID 1212 wrote to memory of 1872 1212 cmd.exe 43 PID 1752 wrote to memory of 1120 1752 java.exe 46 PID 1752 wrote to memory of 1120 1752 java.exe 46 PID 1752 wrote to memory of 1120 1752 java.exe 46 PID 1120 wrote to memory of 1676 1120 cmd.exe 47 PID 1120 wrote to memory of 1676 1120 cmd.exe 47 PID 1120 wrote to memory of 1676 1120 cmd.exe 47 PID 1752 wrote to memory of 1660 1752 java.exe 50 PID 1752 wrote to memory of 1660 1752 java.exe 50 PID 1752 wrote to memory of 1660 1752 java.exe 50 PID 1660 wrote to memory of 1304 1660 cmd.exe 51 PID 1660 wrote to memory of 1304 1660 cmd.exe 51 PID 1660 wrote to memory of 1304 1660 cmd.exe 51
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Annexure A-61322.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\wscript.exewscript C:\Users\Admin\kspzxqsvwb.js2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\hhvaeecsts.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\hhvaeecsts.txt"4⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\hhvaeecsts.txt"5⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\hhvaeecsts.txt"6⤵
- Creates scheduled task(s)
PID:760
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\hhvaeecsts.txt"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1212
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list7⤵PID:1676
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"6⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list7⤵PID:1304
-
-
-
-
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872