fac977e2483a0e3553bf96af6ba237515f5ab9b73ac4236c31fca380898dd884

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fac977e2483a0e3553bf96af6ba237515f5ab9b73ac4236c31fca380898dd884.jar
Size

155KB
MD5

461b72110996d3d4a0a9451c2b17c491
SHA1

fd78d3f3c71fe9a707110116a9e0c4d1e80b958d
SHA256

fac977e2483a0e3553bf96af6ba237515f5ab9b73ac4236c31fca380898dd884
SHA512

4600045e059373b5f5e434d8459eb7d01fb9dd44b480dfe3cd16a15f6d8bb3c19aa7d473f4a4b775b59081ee39b709e75e7c05abbe1066d5a7f9c7c2e1ef60c5

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Java bridge = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\AIR\\jre13v3bridge.jar"	REG.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

REG.exe

pid process

4544 REG.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

java.exe

pid process

2744 java.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2744 wrote to memory of 4544 2744 java.exe REG.exe
PID 2744 wrote to memory of 4544 2744 java.exe REG.exe

pid	process
4544	REG.exe

pid	process
2744	java.exe

description	pid	process	target process
PID 2744 wrote to memory of 4544	2744	java.exe	REG.exe
PID 2744 wrote to memory of 4544	2744	java.exe	REG.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\fac977e2483a0e3553bf96af6ba237515f5ab9b73ac4236c31fca380898dd884.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SYSTEM32\REG.exe
REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Adobe Java bridge" /d "C:\Users\Admin\AppData\Roaming\Adobe\AIR\jre13v3bridge.jar"
2⤵
- Adds Run key to start application
- Modifies registry key
PID:4544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-134-0x0000000002E40000-0x0000000003E40000-memory.dmp

Filesize
16.0MB

Download
memory/4544-140-0x0000000000000000-mapping.dmp

Download