Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
13/12/2021, 15:17
Static task
static1
Behavioral task
behavioral1
Sample
SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar
Resource
win10-en-20211208
General
-
Target
SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar
-
Size
95KB
-
MD5
4d50a1df28610ffdb925d4a5b7bc6c0a
-
SHA1
a5ade474fd1f83cf3ab959668e8736aff6922625
-
SHA256
3380d42b418582b6f23cfd749f3f0851d9bffc66b51b338885f8aa7559479054
-
SHA512
c1199915cddd509e6c149f320779cec6941c2ff361d51e4d5a152db7167b7963e095add1755c6a89987d664387834447932c695fbcfdf5d5cc6301f2f23eba29
Malware Config
Signatures
-
suricata: ET MALWARE STRRAT CnC Checkin
suricata: ET MALWARE STRRAT CnC Checkin
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar java.exe -
Loads dropped DLL 2 IoCs
pid Process 1996 java.exe 1632 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1412 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 588 WMIC.exe Token: SeSecurityPrivilege 588 WMIC.exe Token: SeTakeOwnershipPrivilege 588 WMIC.exe Token: SeLoadDriverPrivilege 588 WMIC.exe Token: SeSystemProfilePrivilege 588 WMIC.exe Token: SeSystemtimePrivilege 588 WMIC.exe Token: SeProfSingleProcessPrivilege 588 WMIC.exe Token: SeIncBasePriorityPrivilege 588 WMIC.exe Token: SeCreatePagefilePrivilege 588 WMIC.exe Token: SeBackupPrivilege 588 WMIC.exe Token: SeRestorePrivilege 588 WMIC.exe Token: SeShutdownPrivilege 588 WMIC.exe Token: SeDebugPrivilege 588 WMIC.exe Token: SeSystemEnvironmentPrivilege 588 WMIC.exe Token: SeRemoteShutdownPrivilege 588 WMIC.exe Token: SeUndockPrivilege 588 WMIC.exe Token: SeManageVolumePrivilege 588 WMIC.exe Token: 33 588 WMIC.exe Token: 34 588 WMIC.exe Token: 35 588 WMIC.exe Token: SeIncreaseQuotaPrivilege 588 WMIC.exe Token: SeSecurityPrivilege 588 WMIC.exe Token: SeTakeOwnershipPrivilege 588 WMIC.exe Token: SeLoadDriverPrivilege 588 WMIC.exe Token: SeSystemProfilePrivilege 588 WMIC.exe Token: SeSystemtimePrivilege 588 WMIC.exe Token: SeProfSingleProcessPrivilege 588 WMIC.exe Token: SeIncBasePriorityPrivilege 588 WMIC.exe Token: SeCreatePagefilePrivilege 588 WMIC.exe Token: SeBackupPrivilege 588 WMIC.exe Token: SeRestorePrivilege 588 WMIC.exe Token: SeShutdownPrivilege 588 WMIC.exe Token: SeDebugPrivilege 588 WMIC.exe Token: SeSystemEnvironmentPrivilege 588 WMIC.exe Token: SeRemoteShutdownPrivilege 588 WMIC.exe Token: SeUndockPrivilege 588 WMIC.exe Token: SeManageVolumePrivilege 588 WMIC.exe Token: 33 588 WMIC.exe Token: 34 588 WMIC.exe Token: 35 588 WMIC.exe Token: SeIncreaseQuotaPrivilege 1656 WMIC.exe Token: SeSecurityPrivilege 1656 WMIC.exe Token: SeTakeOwnershipPrivilege 1656 WMIC.exe Token: SeLoadDriverPrivilege 1656 WMIC.exe Token: SeSystemProfilePrivilege 1656 WMIC.exe Token: SeSystemtimePrivilege 1656 WMIC.exe Token: SeProfSingleProcessPrivilege 1656 WMIC.exe Token: SeIncBasePriorityPrivilege 1656 WMIC.exe Token: SeCreatePagefilePrivilege 1656 WMIC.exe Token: SeBackupPrivilege 1656 WMIC.exe Token: SeRestorePrivilege 1656 WMIC.exe Token: SeShutdownPrivilege 1656 WMIC.exe Token: SeDebugPrivilege 1656 WMIC.exe Token: SeSystemEnvironmentPrivilege 1656 WMIC.exe Token: SeRemoteShutdownPrivilege 1656 WMIC.exe Token: SeUndockPrivilege 1656 WMIC.exe Token: SeManageVolumePrivilege 1656 WMIC.exe Token: 33 1656 WMIC.exe Token: 34 1656 WMIC.exe Token: 35 1656 WMIC.exe Token: SeIncreaseQuotaPrivilege 1656 WMIC.exe Token: SeSecurityPrivilege 1656 WMIC.exe Token: SeTakeOwnershipPrivilege 1656 WMIC.exe Token: SeLoadDriverPrivilege 1656 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1996 1284 java.exe 28 PID 1284 wrote to memory of 1996 1284 java.exe 28 PID 1284 wrote to memory of 1996 1284 java.exe 28 PID 1996 wrote to memory of 1628 1996 java.exe 29 PID 1996 wrote to memory of 1628 1996 java.exe 29 PID 1996 wrote to memory of 1628 1996 java.exe 29 PID 1996 wrote to memory of 1632 1996 java.exe 30 PID 1996 wrote to memory of 1632 1996 java.exe 30 PID 1996 wrote to memory of 1632 1996 java.exe 30 PID 1628 wrote to memory of 1412 1628 cmd.exe 31 PID 1628 wrote to memory of 1412 1628 cmd.exe 31 PID 1628 wrote to memory of 1412 1628 cmd.exe 31 PID 1632 wrote to memory of 1620 1632 java.exe 32 PID 1632 wrote to memory of 1620 1632 java.exe 32 PID 1632 wrote to memory of 1620 1632 java.exe 32 PID 1620 wrote to memory of 588 1620 cmd.exe 33 PID 1620 wrote to memory of 588 1620 cmd.exe 33 PID 1620 wrote to memory of 588 1620 cmd.exe 33 PID 1632 wrote to memory of 1520 1632 java.exe 35 PID 1632 wrote to memory of 1520 1632 java.exe 35 PID 1632 wrote to memory of 1520 1632 java.exe 35 PID 1520 wrote to memory of 1656 1520 cmd.exe 36 PID 1520 wrote to memory of 1656 1520 cmd.exe 36 PID 1520 wrote to memory of 1656 1520 cmd.exe 36 PID 1632 wrote to memory of 1264 1632 java.exe 37 PID 1632 wrote to memory of 1264 1632 java.exe 37 PID 1632 wrote to memory of 1264 1632 java.exe 37 PID 1264 wrote to memory of 692 1264 cmd.exe 38 PID 1264 wrote to memory of 692 1264 cmd.exe 38 PID 1264 wrote to memory of 692 1264 cmd.exe 38 PID 1632 wrote to memory of 1480 1632 java.exe 39 PID 1632 wrote to memory of 1480 1632 java.exe 39 PID 1632 wrote to memory of 1480 1632 java.exe 39 PID 1480 wrote to memory of 1992 1480 cmd.exe 40 PID 1480 wrote to memory of 1992 1480 cmd.exe 40 PID 1480 wrote to memory of 1992 1480 cmd.exe 40
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar"4⤵
- Creates scheduled task(s)
PID:1412
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SHIPMENT_DOCUMENTS_INV-PLIST01256_BL PDF.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:692
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:1992
-
-
-
-