Analysis
-
max time kernel
153s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2022 14:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nope.xlalima.com
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
http://nope.xlalima.com
Resource
win10v2004-20221111-en
General
-
Target
http://nope.xlalima.com
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\PTIN_Reports_PDF.jar family_ratty -
Drops startup file 1 IoCs
Processes:
javaw.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PTIN_Reports_PDF.jar javaw.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
REG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PTIN_Reports_PDF.jar = "C:\\Users\\Admin\\AppData\\Roaming\\PTIN_Reports_PDF.jar" REG.exe -
Drops file in System32 directory 7 IoCs
Processes:
javaw.exedescription ioc process File opened for modification C:\Windows\System32\ntdll.pdb javaw.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb javaw.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb javaw.exe File created C:\Windows\system32\hs_err_pid3048.log javaw.exe File opened for modification C:\Windows\System32\jvm.pdb javaw.exe File opened for modification C:\Windows\System32\dll\jvm.pdb javaw.exe File opened for modification C:\Windows\System32\symbols\dll\jvm.pdb javaw.exe -
Drops file in Program Files directory 12 IoCs
Processes:
javaw.exedescription ioc process File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\server\symbols\dll\ntdll.pdb javaw.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings firefox.exe -
Modifies registry key 1 TTPs 1 IoCs
-
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\PTIN_Reports_PDF.zip:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1020 firefox.exe Token: SeDebugPrivilege 1020 firefox.exe Token: SeDebugPrivilege 1020 firefox.exe Token: SeDebugPrivilege 1020 firefox.exe Token: SeDebugPrivilege 1020 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 1020 firefox.exe 1020 firefox.exe 1020 firefox.exe 1020 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 1020 firefox.exe 1020 firefox.exe 1020 firefox.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
firefox.exejavaw.exepid process 1020 firefox.exe 1020 firefox.exe 1020 firefox.exe 1020 firefox.exe 3048 javaw.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 3272 wrote to memory of 1020 3272 firefox.exe firefox.exe PID 1020 wrote to memory of 1272 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 1272 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3168 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe PID 1020 wrote to memory of 3636 1020 firefox.exe firefox.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3648 attrib.exe 3480 attrib.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" http://nope.xlalima.com1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" http://nope.xlalima.com2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1020.0.1192466338\828168042" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1020 "\\.\pipe\gecko-crash-server-pipe.1020" 1796 gpu3⤵PID:1272
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1020.3.727823915\1247676738" -childID 1 -isForBrowser -prefsHandle 2464 -prefMapHandle 2472 -prefsLen 78 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1020 "\\.\pipe\gecko-crash-server-pipe.1020" 2524 tab3⤵PID:3168
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1020.13.1586505171\964896008" -childID 2 -isForBrowser -prefsHandle 3652 -prefMapHandle 3648 -prefsLen 6860 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1020 "\\.\pipe\gecko-crash-server-pipe.1020" 3664 tab3⤵PID:3636
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4720
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Temp1_PTIN_Reports_PDF.zip\PTIN_Reports_PDF.jar"1⤵
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3048 -
C:\Windows\system32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "PTIN_Reports_PDF.jar" /d "C:\Users\Admin\AppData\Roaming\PTIN_Reports_PDF.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:1544 -
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\PTIN_Reports_PDF.jar2⤵
- Views/modifies file attributes
PID:3648 -
C:\Windows\system32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PTIN_Reports_PDF.jar2⤵
- Views/modifies file attributes
PID:3480
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\PTIN_Reports_PDF.jarFilesize
1.6MB
MD5e66e3afd7ffe6e9e0ae094c13bb33bd0
SHA18480f4693aa2c092246932fe113dae6fa6b41c5c
SHA2564dbea6f56aff63990206432af8777f6e5ef57173d65770ef9ca254cafcc99fab
SHA5125913d4792ff5dba9f5d48e7be8c66645f7336ec297668b93a4726f6c03f366cf80de078a1778c789120b70320555c51fea90d84065003acfecfbcd5ad437f865
-
memory/1544-149-0x0000000000000000-mapping.dmp
-
memory/3048-141-0x0000000003240000-0x0000000004240000-memory.dmpFilesize
16.0MB
-
memory/3048-155-0x0000000003240000-0x0000000004240000-memory.dmpFilesize
16.0MB
-
memory/3048-161-0x0000000003240000-0x0000000004240000-memory.dmpFilesize
16.0MB
-
memory/3048-162-0x0000000003240000-0x0000000004240000-memory.dmpFilesize
16.0MB
-
memory/3480-151-0x0000000000000000-mapping.dmp
-
memory/3648-150-0x0000000000000000-mapping.dmp