d61e712d33eb5c948bb64c232292e64add9fbe64172163b2eaaa333a017edce3

Analysis

max time kernel
48s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Orderlist.jar
Size 479KB
Sample221109-nnv1ssaahp
SHA256 d61e712d33eb5c948bb64c232292e64add9fbe64172163b2eaaa333a017edce3
MD5 0615a57d8258d087eff7efce8c772f34
SHA1 494d40db7937bf7afbff18aef4f1ddd7d44a6a98
SHA512 572dffc02e698320dc574420e041ab280d318dabfcdd707ec85c3fc10a6a159f96d26beb9a6152f7f74c52bcc2a176ea371c755d9846c90b168294772d5e1fda
SSDEEP 6144:5Xyx0hqD0/4EeyeYW3DMVE9PjMUSI5pxUb7gvY8ulmcCV/hIl0/0c2qna3PJ7phZ:5isZNWzMgjMq5pxogQNUhIK/0c2qnAX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 3348	1428	java.exe	79
PID 1428 wrote to memory of 3348	1428	java.exe	79

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Orderlist.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files\Java\jre1.8.0_66\bin\java.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.82965900996303922822387944762736597.class
  2⤵
  PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

90737d32e3aba4b.timestamp

Path C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Size 50B
SHA256 b14fda32d3d071a4d2600f92ae4d7838f65eb13175830f7e100d9bae0cf2d071
MD5 3159e4a7a21d45208040762b97b1857b
SHA1 d101307fb84df91b279fb35113a6d800e45ecf05
SHA512 ed44726d5b7ea27801b4739390e0872f63decaeeb15a1417e1fabf8cc2dd0aacffe652e8bb0315f3e2e0db369b01d09c022daaff08bde0a5fb890f76ccf04acc
MD5 SHA1 SHA512

Submit Download

_0.82965900996303922822387944762736597.class

Path C:\Users\Admin\AppData\Local\Temp\_0.82965900996303922822387944762736597.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_9be0bf4d-f8db-4af4-be85-dc38433c9501

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2891029575-1462575-1165213807-1000\83aa4cc77f591dfc2374580bbd95f6ba_9be0bf4d-f8db-4af4-be85-dc38433c9501
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/1428-134-0x00000000032C0000-0x00000000042C0000-memory.dmp

Download

memory/1428-159-0x00000000032C0000-0x00000000042C0000-memory.dmp

Download

memory/1428-167-0x00000000032C0000-0x00000000042C0000-memory.dmp

Download

memory/3348-154-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Download

memory/3348-165-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Download

memory/3348-166-0x0000000002EE0000-0x0000000003EE0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads