Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13/12/2021, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
Scanned.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Scanned.jar
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
Scanned.jar
-
Size
101KB
-
MD5
1c26fc689838571c525ab1956f441c92
-
SHA1
873619c5b8264326cfb53c1a025b1bddf4da6e2a
-
SHA256
0a6b8da241ae9c2fb8b7b8095ab51da1caedc0af4d56185bc47bb2b8158d8dc0
-
SHA512
d6096c005f7366308deadd53f910dd3b3c248e3a2d4ff62fe59628fa6072939d6a7715221c1fabeeaa9648c7771c73805f96b82f936f5bd24b3daa69d8aa9bdf
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Scanned.jar java.exe -
Loads dropped DLL 2 IoCs
pid Process 1844 java.exe 1700 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Scanned = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Scanned.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Scanned = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Scanned.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1760 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1564 WMIC.exe Token: SeSecurityPrivilege 1564 WMIC.exe Token: SeTakeOwnershipPrivilege 1564 WMIC.exe Token: SeLoadDriverPrivilege 1564 WMIC.exe Token: SeSystemProfilePrivilege 1564 WMIC.exe Token: SeSystemtimePrivilege 1564 WMIC.exe Token: SeProfSingleProcessPrivilege 1564 WMIC.exe Token: SeIncBasePriorityPrivilege 1564 WMIC.exe Token: SeCreatePagefilePrivilege 1564 WMIC.exe Token: SeBackupPrivilege 1564 WMIC.exe Token: SeRestorePrivilege 1564 WMIC.exe Token: SeShutdownPrivilege 1564 WMIC.exe Token: SeDebugPrivilege 1564 WMIC.exe Token: SeSystemEnvironmentPrivilege 1564 WMIC.exe Token: SeRemoteShutdownPrivilege 1564 WMIC.exe Token: SeUndockPrivilege 1564 WMIC.exe Token: SeManageVolumePrivilege 1564 WMIC.exe Token: 33 1564 WMIC.exe Token: 34 1564 WMIC.exe Token: 35 1564 WMIC.exe Token: SeIncreaseQuotaPrivilege 1564 WMIC.exe Token: SeSecurityPrivilege 1564 WMIC.exe Token: SeTakeOwnershipPrivilege 1564 WMIC.exe Token: SeLoadDriverPrivilege 1564 WMIC.exe Token: SeSystemProfilePrivilege 1564 WMIC.exe Token: SeSystemtimePrivilege 1564 WMIC.exe Token: SeProfSingleProcessPrivilege 1564 WMIC.exe Token: SeIncBasePriorityPrivilege 1564 WMIC.exe Token: SeCreatePagefilePrivilege 1564 WMIC.exe Token: SeBackupPrivilege 1564 WMIC.exe Token: SeRestorePrivilege 1564 WMIC.exe Token: SeShutdownPrivilege 1564 WMIC.exe Token: SeDebugPrivilege 1564 WMIC.exe Token: SeSystemEnvironmentPrivilege 1564 WMIC.exe Token: SeRemoteShutdownPrivilege 1564 WMIC.exe Token: SeUndockPrivilege 1564 WMIC.exe Token: SeManageVolumePrivilege 1564 WMIC.exe Token: 33 1564 WMIC.exe Token: 34 1564 WMIC.exe Token: 35 1564 WMIC.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe Token: SeSystemProfilePrivilege 1248 WMIC.exe Token: SeSystemtimePrivilege 1248 WMIC.exe Token: SeProfSingleProcessPrivilege 1248 WMIC.exe Token: SeIncBasePriorityPrivilege 1248 WMIC.exe Token: SeCreatePagefilePrivilege 1248 WMIC.exe Token: SeBackupPrivilege 1248 WMIC.exe Token: SeRestorePrivilege 1248 WMIC.exe Token: SeShutdownPrivilege 1248 WMIC.exe Token: SeDebugPrivilege 1248 WMIC.exe Token: SeSystemEnvironmentPrivilege 1248 WMIC.exe Token: SeRemoteShutdownPrivilege 1248 WMIC.exe Token: SeUndockPrivilege 1248 WMIC.exe Token: SeManageVolumePrivilege 1248 WMIC.exe Token: 33 1248 WMIC.exe Token: 34 1248 WMIC.exe Token: 35 1248 WMIC.exe Token: SeIncreaseQuotaPrivilege 1248 WMIC.exe Token: SeSecurityPrivilege 1248 WMIC.exe Token: SeTakeOwnershipPrivilege 1248 WMIC.exe Token: SeLoadDriverPrivilege 1248 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1844 1540 java.exe 28 PID 1540 wrote to memory of 1844 1540 java.exe 28 PID 1540 wrote to memory of 1844 1540 java.exe 28 PID 1844 wrote to memory of 1912 1844 java.exe 29 PID 1844 wrote to memory of 1912 1844 java.exe 29 PID 1844 wrote to memory of 1912 1844 java.exe 29 PID 1844 wrote to memory of 1700 1844 java.exe 30 PID 1844 wrote to memory of 1700 1844 java.exe 30 PID 1844 wrote to memory of 1700 1844 java.exe 30 PID 1912 wrote to memory of 1760 1912 cmd.exe 31 PID 1912 wrote to memory of 1760 1912 cmd.exe 31 PID 1912 wrote to memory of 1760 1912 cmd.exe 31 PID 1700 wrote to memory of 1960 1700 java.exe 34 PID 1700 wrote to memory of 1960 1700 java.exe 34 PID 1700 wrote to memory of 1960 1700 java.exe 34 PID 1960 wrote to memory of 1564 1960 cmd.exe 35 PID 1960 wrote to memory of 1564 1960 cmd.exe 35 PID 1960 wrote to memory of 1564 1960 cmd.exe 35 PID 1700 wrote to memory of 1644 1700 java.exe 37 PID 1700 wrote to memory of 1644 1700 java.exe 37 PID 1700 wrote to memory of 1644 1700 java.exe 37 PID 1644 wrote to memory of 1248 1644 cmd.exe 38 PID 1644 wrote to memory of 1248 1644 cmd.exe 38 PID 1644 wrote to memory of 1248 1644 cmd.exe 38 PID 1700 wrote to memory of 1968 1700 java.exe 39 PID 1700 wrote to memory of 1968 1700 java.exe 39 PID 1700 wrote to memory of 1968 1700 java.exe 39 PID 1968 wrote to memory of 304 1968 cmd.exe 40 PID 1968 wrote to memory of 304 1968 cmd.exe 40 PID 1968 wrote to memory of 304 1968 cmd.exe 40 PID 1700 wrote to memory of 1744 1700 java.exe 41 PID 1700 wrote to memory of 1744 1700 java.exe 41 PID 1700 wrote to memory of 1744 1700 java.exe 41 PID 1744 wrote to memory of 1480 1744 cmd.exe 42 PID 1744 wrote to memory of 1480 1744 cmd.exe 42 PID 1744 wrote to memory of 1480 1744 cmd.exe 42
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Scanned.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Scanned.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Scanned.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Scanned.jar"4⤵
- Creates scheduled task(s)
PID:1760
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Scanned.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:304
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:1480
-
-
-
-