Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/01/2022, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
Remittance_Advice.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Remittance_Advice.jar
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
Remittance_Advice.jar
-
Size
177KB
-
MD5
e5df17e52c9ad8157ef9ad8c42072f6e
-
SHA1
7b998e5455ffeef99cbf3e02e8ff057220ce9749
-
SHA256
6a695e198d37c905288cf2ad103315559c7f870a2f92b03fbdcfabe0a8a34ba6
-
SHA512
c8983cf43ef8dcfd651dd2ae788b2f1b97bfff5fe0406c1bcbe4a5d30b6adae005208a9463e3f9163bc6b7439a252547c2ccb110da77e8f33c450087e855542e
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Remittance_Advice.jar java.exe -
Loads dropped DLL 1 IoCs
pid Process 1152 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remittance_Advice = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Remittance_Advice.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remittance_Advice = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Remittance_Advice.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1300 schtasks.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1152 1520 java.exe 28 PID 1520 wrote to memory of 1152 1520 java.exe 28 PID 1520 wrote to memory of 1152 1520 java.exe 28 PID 1152 wrote to memory of 1628 1152 java.exe 29 PID 1152 wrote to memory of 1628 1152 java.exe 29 PID 1152 wrote to memory of 1628 1152 java.exe 29 PID 1152 wrote to memory of 1644 1152 java.exe 30 PID 1152 wrote to memory of 1644 1152 java.exe 30 PID 1152 wrote to memory of 1644 1152 java.exe 30 PID 1628 wrote to memory of 1300 1628 cmd.exe 31 PID 1628 wrote to memory of 1300 1628 cmd.exe 31 PID 1628 wrote to memory of 1300 1628 cmd.exe 31
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Remittance_Advice.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Remittance_Advice.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"4⤵
- Creates scheduled task(s)
PID:1300
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Remittance_Advice.jar"3⤵PID:1644
-
-