91799667148b7be1b1d9aa749e5e63da8b529250478c90fee291336551c1544f | Triage

Analysis

max time kernel
120s
max time network
137s
platform
windows10_x64
resource
win10-en-20210920
submitted
25-10-2021 06:13

Sharing

Report Analysis Logs

General

Target

Payment slip.jar
Size

184KB
MD5

8829ede47aa2e3f8aece3e8ffcc2ba1a
SHA1

a0fa240b8db1c3ddb42066ac0ddbb8513d005665
SHA256

91799667148b7be1b1d9aa749e5e63da8b529250478c90fee291336551c1544f
SHA512

657290510a7472638de1adfa19d9fe5c00bd26ac8903398d44c0f32248094a5c365c17c0c28078be0c1a986cefe06256f0b47c1f69b50ba6a39fca31a2ad8a50

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Payment slip.jar"
1⤵
- Drops file in Program Files directory
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-115-0x0000000002AF0000-0x0000000002D60000-memory.dmp

Filesize
2.4MB

Download
memory/1648-116-0x0000000002AF0000-0x0000000002D60000-memory.dmp

Filesize
2.4MB

Download
memory/1648-117-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

Filesize
4KB

Download
memory/1648-120-0x0000000002D60000-0x0000000002D70000-memory.dmp

Filesize
64KB

Download