19e420fa324f949c36ed0ddd6aa97d5eab890520b86947635b16faea7fb6ed31 | Triage

Resubmissions

28-04-2024 18:21

240428-wzag8sdf92 7

31-05-2022 00:02

220531-abew6abfbp 10

Analysis

max time kernel
141s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
31-05-2022 00:02

Sharing

Report Analysis Logs

General

Target

PAYMENT 1567_0001.jar
Size

5KB
MD5

ae3ae22d472b3dd08af516fc826b37bb
SHA1

0bc1a94d03c44d4ddcc1458d32f91e71eb82ab43
SHA256

b5ba14af96ed4c62864c7a6659bcbebae1988edd0907c649c36b6c4ef6b67be5
SHA512

06153f7ed32e213ce1de1f255b53b9df44205e00fb9c3c7e034a018d46416f903b5aaa1c33d1d42586e7287228b3e5646f7df0c7492cb9baa1777278ee32b8f2

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb	java.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\PAYMENT 1567_0001.jar"
1⤵
- Drops file in Program Files directory
PID:788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-132-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

Filesize
16.0MB

Download
memory/788-146-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

Filesize
16.0MB

Download
memory/788-147-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

Filesize
16.0MB

Download
memory/788-148-0x0000000002FE0000-0x0000000003FE0000-memory.dmp

Filesize
16.0MB

Download