Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
18/12/2021, 08:50
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENTS_00298761 PDF.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENTS_00298761 PDF.jar
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
SHIPPING DOCUMENTS_00298761 PDF.jar
-
Size
95KB
-
MD5
94c7b2d865bde2640f25675a1c4f6505
-
SHA1
9d535b02ae1babcf0a0f15c2925b4b8a0ba02ba9
-
SHA256
dd3b94cbb244bf2e3ee0154ad78e2d352af3fd95a976abe5f5f3f2d4d630a873
-
SHA512
36250bb4633e68d08d62c452a73ace0255705fc4c2a2b7e1252a69033293e4b58028df7bde4191ecccfe33651fff8c79d8ce833b75cfb1bbf7180b68f6f590fe
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SHIPPING DOCUMENTS_00298761 PDF.jar java.exe -
Loads dropped DLL 2 IoCs
pid Process 1824 java.exe 1892 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\SHIPPING DOCUMENTS_00298761 PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SHIPPING DOCUMENTS_00298761 PDF.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SHIPPING DOCUMENTS_00298761 PDF = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\SHIPPING DOCUMENTS_00298761 PDF.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1736 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1824 1648 java.exe 28 PID 1648 wrote to memory of 1824 1648 java.exe 28 PID 1648 wrote to memory of 1824 1648 java.exe 28 PID 1824 wrote to memory of 1672 1824 java.exe 29 PID 1824 wrote to memory of 1672 1824 java.exe 29 PID 1824 wrote to memory of 1672 1824 java.exe 29 PID 1824 wrote to memory of 1892 1824 java.exe 30 PID 1824 wrote to memory of 1892 1824 java.exe 30 PID 1824 wrote to memory of 1892 1824 java.exe 30 PID 1672 wrote to memory of 1736 1672 cmd.exe 31 PID 1672 wrote to memory of 1736 1672 cmd.exe 31 PID 1672 wrote to memory of 1736 1672 cmd.exe 31
Processes
-
C:\Windows\system32\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENTS_00298761 PDF.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\SHIPPING DOCUMENTS_00298761 PDF.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCUMENTS_00298761 PDF.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SHIPPING DOCUMENTS_00298761 PDF.jar"4⤵
- Creates scheduled task(s)
PID:1736
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SHIPPING DOCUMENTS_00298761 PDF.jar"3⤵
- Loads dropped DLL
PID:1892
-
-