f65560db6d40b39dfeaf00b35abc340fda495d8334aac6e7741a9c126cd24b3d

Analysis

max time kernel
144s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
24-05-2022 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f65560db6d40b39dfeaf00b35abc340fda495d8334aac6e7741a9c126cd24b3d.jar
Size

155KB
MD5

7b343285af95a6c9f69b26f73e76a41d
SHA1

a73ab5c168108bd468ccde4b24516fc670dba3f7
SHA256

f65560db6d40b39dfeaf00b35abc340fda495d8334aac6e7741a9c126cd24b3d
SHA512

653e10236479be9c65475b20a4cf629a26aeaad4000a8ee6c5fba9a1f848afa544491781c19ace51b635fccdfa6749ae938673defd2d470788831acb7fefa508

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Java bridge = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\AIR\\jre13v3bridge.jar"	REG.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4424	REG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4424	1656	java.exe	84
PID 1656 wrote to memory of 4424	1656	java.exe	84

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\f65560db6d40b39dfeaf00b35abc340fda495d8334aac6e7741a9c126cd24b3d.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Adobe Java bridge" /d "C:\Users\Admin\AppData\Roaming\Adobe\AIR\jre13v3bridge.jar"
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-132-0x0000000003430000-0x0000000004430000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads