Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21/01/2022, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
Details.jar
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Details.jar
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
Details.jar
-
Size
177KB
-
MD5
4d0c222fc711df5287903997326017b3
-
SHA1
8da0d12aefac5d5186ef207386a8ea55dbca65c2
-
SHA256
2eccadabbc22b45eda0581964ea8f540f7068f331c6a8f02df3ff84a5c625334
-
SHA512
5f6a248ebf72c33e0ceded0a2317e314193529b029c8cde6c8ac9bb8730d8433cf00f155fbfa568377245fa7c3f2eab88b17ad600406032386d36ec0c2585cc4
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Details.jar java.exe -
Loads dropped DLL 2 IoCs
pid Process 1376 java.exe 1064 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Details = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Details.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Details = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Details.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1592 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe Token: SeIncreaseQuotaPrivilege 1364 WMIC.exe Token: SeSecurityPrivilege 1364 WMIC.exe Token: SeTakeOwnershipPrivilege 1364 WMIC.exe Token: SeLoadDriverPrivilege 1364 WMIC.exe Token: SeSystemProfilePrivilege 1364 WMIC.exe Token: SeSystemtimePrivilege 1364 WMIC.exe Token: SeProfSingleProcessPrivilege 1364 WMIC.exe Token: SeIncBasePriorityPrivilege 1364 WMIC.exe Token: SeCreatePagefilePrivilege 1364 WMIC.exe Token: SeBackupPrivilege 1364 WMIC.exe Token: SeRestorePrivilege 1364 WMIC.exe Token: SeShutdownPrivilege 1364 WMIC.exe Token: SeDebugPrivilege 1364 WMIC.exe Token: SeSystemEnvironmentPrivilege 1364 WMIC.exe Token: SeRemoteShutdownPrivilege 1364 WMIC.exe Token: SeUndockPrivilege 1364 WMIC.exe Token: SeManageVolumePrivilege 1364 WMIC.exe Token: 33 1364 WMIC.exe Token: 34 1364 WMIC.exe Token: 35 1364 WMIC.exe Token: SeIncreaseQuotaPrivilege 1364 WMIC.exe Token: SeSecurityPrivilege 1364 WMIC.exe Token: SeTakeOwnershipPrivilege 1364 WMIC.exe Token: SeLoadDriverPrivilege 1364 WMIC.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 980 wrote to memory of 1376 980 java.exe 28 PID 980 wrote to memory of 1376 980 java.exe 28 PID 980 wrote to memory of 1376 980 java.exe 28 PID 1376 wrote to memory of 2020 1376 java.exe 29 PID 1376 wrote to memory of 2020 1376 java.exe 29 PID 1376 wrote to memory of 2020 1376 java.exe 29 PID 1376 wrote to memory of 1064 1376 java.exe 30 PID 1376 wrote to memory of 1064 1376 java.exe 30 PID 1376 wrote to memory of 1064 1376 java.exe 30 PID 2020 wrote to memory of 1592 2020 cmd.exe 31 PID 2020 wrote to memory of 1592 2020 cmd.exe 31 PID 2020 wrote to memory of 1592 2020 cmd.exe 31 PID 1064 wrote to memory of 632 1064 java.exe 32 PID 1064 wrote to memory of 632 1064 java.exe 32 PID 1064 wrote to memory of 632 1064 java.exe 32 PID 632 wrote to memory of 1884 632 cmd.exe 33 PID 632 wrote to memory of 1884 632 cmd.exe 33 PID 632 wrote to memory of 1884 632 cmd.exe 33 PID 1064 wrote to memory of 788 1064 java.exe 35 PID 1064 wrote to memory of 788 1064 java.exe 35 PID 1064 wrote to memory of 788 1064 java.exe 35 PID 788 wrote to memory of 1364 788 cmd.exe 36 PID 788 wrote to memory of 1364 788 cmd.exe 36 PID 788 wrote to memory of 1364 788 cmd.exe 36 PID 1064 wrote to memory of 1204 1064 java.exe 37 PID 1064 wrote to memory of 1204 1064 java.exe 37 PID 1064 wrote to memory of 1204 1064 java.exe 37 PID 1204 wrote to memory of 1380 1204 cmd.exe 38 PID 1204 wrote to memory of 1380 1204 cmd.exe 38 PID 1204 wrote to memory of 1380 1204 cmd.exe 38 PID 1064 wrote to memory of 1368 1064 java.exe 39 PID 1064 wrote to memory of 1368 1064 java.exe 39 PID 1064 wrote to memory of 1368 1064 java.exe 39 PID 1368 wrote to memory of 1720 1368 cmd.exe 40 PID 1368 wrote to memory of 1720 1368 cmd.exe 40 PID 1368 wrote to memory of 1720 1368 cmd.exe 40
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Details.jar1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\Details.jar"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Details.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Details.jar"4⤵
- Creates scheduled task(s)
PID:1592
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Details.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:1380
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list5⤵PID:1720
-
-
-
-