Overview

overview

10

Static

static

jennymod.jar

windows10-2004-x64

10

Resubmissions

12-09-2023 06:44

230912-hhhwdsec82 1

08-10-2022 14:46

221008-r5jwmsfacj 10

08-10-2022 14:42

221008-r22maafabq 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    jennymod.jar

  • Size

    13.4MB

  • Sample

    221008-r5jwmsfacj

  • MD5

    b05f920d15dfa6884f8ac79ef37b6c0f

  • SHA1

    438c1bf2037c093f6213270e4f2581f4bea6912e

  • SHA256

    3d4fc6583077d42c76625669ffdabc9e272e33bfe5f1ff166e7f7b596384ba63

  • SHA512

    4c800b30e063645380c35b86be2b82eeae9a134dba66ec945c351b69c4c8db28fa7c20b3aed9c36fced7bc3eb34af58f99021448d0147e7de9e942b699ed6315

  • SSDEEP

    393216:PWep5Dm2XFQghnwUlTviPnYlocqVmnQ0ILYvLJadUVlfC0T/:P5pNm2XFQgpwmvP5QpLAX

Score
10/10
cobaltstrikexmrigbackdoordiscoveryminerpersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      jennymod.jar

    • Size

      13.4MB

    • MD5

      b05f920d15dfa6884f8ac79ef37b6c0f

    • SHA1

      438c1bf2037c093f6213270e4f2581f4bea6912e

    • SHA256

      3d4fc6583077d42c76625669ffdabc9e272e33bfe5f1ff166e7f7b596384ba63

    • SHA512

      4c800b30e063645380c35b86be2b82eeae9a134dba66ec945c351b69c4c8db28fa7c20b3aed9c36fced7bc3eb34af58f99021448d0147e7de9e942b699ed6315

    • SSDEEP

      393216:PWep5Dm2XFQghnwUlTviPnYlocqVmnQ0ILYvLJadUVlfC0T/:P5pNm2XFQgpwmvP5QpLAX

    Score
    10/10
    cobaltstrikexmrigbackdoordiscoveryminerpersistencespywarestealertrojanupx

    • Cobaltstrike

      Detected malicious payload which is part of Cobaltstrike.

      trojanbackdoorcobaltstrike

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Registers COM server for autorun

      persistence

    • Registers new Print Monitor

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

4
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

7
T1012

System Information Discovery

7
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks