Analysis
-
max time kernel
111s -
max time network
120s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
02-06-2021 13:11
Static task
static1
Behavioral task
behavioral1
Sample
Customers Copy.jar
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Customers Copy.jar
Resource
win10v20210408
General
-
Target
Customers Copy.jar
-
Size
88KB
-
MD5
0e55c05d788d4da90b52984d7728a897
-
SHA1
b5aae7d06d912aaa6b97c4363dab857f03f2c7b9
-
SHA256
00ef6637bea63d139f497f9b19c72bc526b85ab40d4ed62a1558930c0ebaa6e5
-
SHA512
879158d6afb38b4a1744e421d758f301b097224d6b55076904c9b06ecdc3dee64ef09824881fe6d3f9e599aca99805af54354b9f4c07a06c0421023bea6b5cf5
Malware Config
Signatures
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 2988 wrote to memory of 1524 2988 java.exe java.exe PID 2988 wrote to memory of 1524 2988 java.exe java.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Customers Copy.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\Customers Copy.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestampMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\Customers Copy.jarMD5
0e55c05d788d4da90b52984d7728a897
SHA1b5aae7d06d912aaa6b97c4363dab857f03f2c7b9
SHA25600ef6637bea63d139f497f9b19c72bc526b85ab40d4ed62a1558930c0ebaa6e5
SHA512879158d6afb38b4a1744e421d758f301b097224d6b55076904c9b06ecdc3dee64ef09824881fe6d3f9e599aca99805af54354b9f4c07a06c0421023bea6b5cf5
-
C:\Users\Admin\lib\jna-5.5.0.jarMD5
acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
C:\Users\Admin\lib\jna-platform-5.5.0.jarMD5
2f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jarMD5
b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
C:\Users\Admin\lib\system-hook-3.5.jarMD5
e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
memory/1524-205-0x0000000000000000-mapping.dmp
-
memory/1524-215-0x0000000002FE0000-0x0000000002FF0000-memory.dmpFilesize
64KB
-
memory/1524-214-0x0000000002FD0000-0x0000000002FE0000-memory.dmpFilesize
64KB
-
memory/1524-213-0x0000000002FC0000-0x0000000002FD0000-memory.dmpFilesize
64KB
-
memory/1524-212-0x0000000002D50000-0x0000000002FC0000-memory.dmpFilesize
2.4MB
-
memory/2988-181-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-198-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2988-138-0x0000000002840000-0x0000000002850000-memory.dmpFilesize
64KB
-
memory/2988-139-0x0000000002850000-0x0000000002860000-memory.dmpFilesize
64KB
-
memory/2988-140-0x0000000002860000-0x0000000002870000-memory.dmpFilesize
64KB
-
memory/2988-141-0x0000000002870000-0x0000000002880000-memory.dmpFilesize
64KB
-
memory/2988-142-0x0000000002880000-0x0000000002890000-memory.dmpFilesize
64KB
-
memory/2988-144-0x0000000002890000-0x00000000028A0000-memory.dmpFilesize
64KB
-
memory/2988-147-0x00000000028A0000-0x00000000028B0000-memory.dmpFilesize
64KB
-
memory/2988-157-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-178-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-114-0x0000000002550000-0x00000000027C0000-memory.dmpFilesize
2.4MB
-
memory/2988-184-0x00000000028B0000-0x00000000028C0000-memory.dmpFilesize
64KB
-
memory/2988-185-0x00000000028C0000-0x00000000028D0000-memory.dmpFilesize
64KB
-
memory/2988-187-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-197-0x00000000028E0000-0x00000000028F0000-memory.dmpFilesize
64KB
-
memory/2988-196-0x00000000028D0000-0x00000000028E0000-memory.dmpFilesize
64KB
-
memory/2988-137-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/2988-199-0x0000000002900000-0x0000000002910000-memory.dmpFilesize
64KB
-
memory/2988-200-0x0000000002910000-0x0000000002920000-memory.dmpFilesize
64KB
-
memory/2988-201-0x0000000002920000-0x0000000002930000-memory.dmpFilesize
64KB
-
memory/2988-202-0x0000000002930000-0x0000000002940000-memory.dmpFilesize
64KB
-
memory/2988-203-0x0000000002940000-0x0000000002950000-memory.dmpFilesize
64KB
-
memory/2988-204-0x0000000002950000-0x0000000002960000-memory.dmpFilesize
64KB
-
memory/2988-136-0x0000000002820000-0x0000000002830000-memory.dmpFilesize
64KB
-
memory/2988-134-0x0000000002810000-0x0000000002820000-memory.dmpFilesize
64KB
-
memory/2988-133-0x0000000002800000-0x0000000002810000-memory.dmpFilesize
64KB
-
memory/2988-132-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/2988-122-0x00000000027E0000-0x00000000027F0000-memory.dmpFilesize
64KB
-
memory/2988-120-0x00000000027D0000-0x00000000027E0000-memory.dmpFilesize
64KB
-
memory/2988-121-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-118-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-119-0x00000000027C0000-0x00000000027D0000-memory.dmpFilesize
64KB
-
memory/2988-116-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2988-115-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB