Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-05-2021 13:21
Static task
static1
Behavioral task
behavioral1
Sample
F14 PO pdf.jar
Resource
win7v20210408
Behavioral task
behavioral2
Sample
F14 PO pdf.jar
Resource
win10v20210408
General
-
Target
F14 PO pdf.jar
-
Size
101KB
-
MD5
36dcd262d70e5127c413253598ebdd87
-
SHA1
2ad94aa5e8366c843f9451e774d48350a6f9c432
-
SHA256
1b27fd330da9cc668f6d2e823523cf676e8c5020b0975f68d0d6125d17c03792
-
SHA512
50b87b296ad5214a0a628915556f90e158cb9c099b41ba097ea8181d79524864889ba65595350542363c7d66dbf80f3c37370e74119321f4a302e61542f517d7
Malware Config
Signatures
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 584 wrote to memory of 3860 584 java.exe java.exe PID 584 wrote to memory of 3860 584 java.exe java.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\F14 PO pdf.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\F14 PO pdf.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\F14 PO pdf.jarMD5
36dcd262d70e5127c413253598ebdd87
SHA12ad94aa5e8366c843f9451e774d48350a6f9c432
SHA2561b27fd330da9cc668f6d2e823523cf676e8c5020b0975f68d0d6125d17c03792
SHA51250b87b296ad5214a0a628915556f90e158cb9c099b41ba097ea8181d79524864889ba65595350542363c7d66dbf80f3c37370e74119321f4a302e61542f517d7
-
C:\Users\Admin\lib\jna-5.5.0.jarMD5
acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\lib\jna-platform-5.5.0.jarMD5
2f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jarMD5
b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\lib\system-hook-3.5.jarMD5
e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
memory/584-147-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-123-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/584-120-0x0000000002590000-0x00000000025A0000-memory.dmpFilesize
64KB
-
memory/584-121-0x00000000025A0000-0x00000000025B0000-memory.dmpFilesize
64KB
-
memory/584-118-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/584-122-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-152-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-125-0x00000000025D0000-0x00000000025E0000-memory.dmpFilesize
64KB
-
memory/584-124-0x00000000025C0000-0x00000000025D0000-memory.dmpFilesize
64KB
-
memory/584-126-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/584-127-0x00000000025F0000-0x0000000002600000-memory.dmpFilesize
64KB
-
memory/584-128-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/584-129-0x0000000002610000-0x0000000002620000-memory.dmpFilesize
64KB
-
memory/584-130-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/584-131-0x0000000002630000-0x0000000002640000-memory.dmpFilesize
64KB
-
memory/584-140-0x0000000002640000-0x0000000002650000-memory.dmpFilesize
64KB
-
memory/584-141-0x0000000002650000-0x0000000002660000-memory.dmpFilesize
64KB
-
memory/584-144-0x0000000002680000-0x0000000002690000-memory.dmpFilesize
64KB
-
memory/584-151-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-143-0x0000000002660000-0x0000000002670000-memory.dmpFilesize
64KB
-
memory/584-148-0x0000000002670000-0x0000000002680000-memory.dmpFilesize
64KB
-
memory/584-149-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-117-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-150-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-146-0x0000000002690000-0x00000000026A0000-memory.dmpFilesize
64KB
-
memory/584-119-0x0000000002580000-0x0000000002590000-memory.dmpFilesize
64KB
-
memory/584-153-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-155-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-154-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-157-0x00000000026B0000-0x00000000026C0000-memory.dmpFilesize
64KB
-
memory/584-156-0x00000000026A0000-0x00000000026B0000-memory.dmpFilesize
64KB
-
memory/584-160-0x0000000002710000-0x0000000002720000-memory.dmpFilesize
64KB
-
memory/584-159-0x00000000026C0000-0x00000000026D0000-memory.dmpFilesize
64KB
-
memory/584-161-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-162-0x00000000026D0000-0x00000000026E0000-memory.dmpFilesize
64KB
-
memory/584-163-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-164-0x00000000026E0000-0x00000000026F0000-memory.dmpFilesize
64KB
-
memory/584-166-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-165-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/584-167-0x0000000002700000-0x0000000002710000-memory.dmpFilesize
64KB
-
memory/584-168-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-170-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-115-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-114-0x0000000002300000-0x0000000002570000-memory.dmpFilesize
2.4MB
-
memory/584-172-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-173-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-176-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/584-181-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/3860-180-0x0000000000000000-mapping.dmp
-
memory/3860-188-0x00000000028E0000-0x0000000002B50000-memory.dmpFilesize
2.4MB
-
memory/3860-189-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB