Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
07/12/2021, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENTS FOR SHIPMENTS PDF XLS.jar
Resource
win7-en-20211014
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DOCUMENTS FOR SHIPMENTS PDF XLS.jar
Resource
win10-en-20211104
0 signatures
0 seconds
General
-
Target
DOCUMENTS FOR SHIPMENTS PDF XLS.jar
-
Size
284KB
-
MD5
651a47b5e2e3638430e6148e79a7e23b
-
SHA1
c8aaea1eaace67c045413c445d17c71af3e8c0fa
-
SHA256
bb3be9616c4b23e2f5cda17b56b8656a5d71f643fdf545056c97a242b69a6115
-
SHA512
3f680a9e80eff306ad4386991b33fe1d171eec0d8c1ad3f1e8c4d9322275f049befa0ada6cb53e8f01cda3809bb29e454cdade59c22ae20cfc53add056ff2324
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOCUMENTS FOR SHIPMENTS PDF XLS.jar java.exe -
Loads dropped DLL 2 IoCs
pid Process 1272 java.exe 1996 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\DOCUMENTS FOR SHIPMENTS PDF XLS = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\DOCUMENTS FOR SHIPMENTS PDF XLS.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DOCUMENTS FOR SHIPMENTS PDF XLS = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\DOCUMENTS FOR SHIPMENTS PDF XLS.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1596 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1272 1140 java.exe 29 PID 1140 wrote to memory of 1272 1140 java.exe 29 PID 1140 wrote to memory of 1272 1140 java.exe 29 PID 1272 wrote to memory of 1512 1272 java.exe 30 PID 1272 wrote to memory of 1512 1272 java.exe 30 PID 1272 wrote to memory of 1512 1272 java.exe 30 PID 1272 wrote to memory of 1996 1272 java.exe 31 PID 1272 wrote to memory of 1996 1272 java.exe 31 PID 1272 wrote to memory of 1996 1272 java.exe 31 PID 1512 wrote to memory of 1596 1512 cmd.exe 32 PID 1512 wrote to memory of 1596 1512 cmd.exe 32 PID 1512 wrote to memory of 1596 1512 cmd.exe 32
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\DOCUMENTS FOR SHIPMENTS PDF XLS.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\DOCUMENTS FOR SHIPMENTS PDF XLS.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\DOCUMENTS FOR SHIPMENTS PDF XLS.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\DOCUMENTS FOR SHIPMENTS PDF XLS.jar"4⤵
- Creates scheduled task(s)
PID:1596
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\DOCUMENTS FOR SHIPMENTS PDF XLS.jar"3⤵
- Loads dropped DLL
PID:1996
-
-