Analysis
-
max time kernel
18s -
max time network
68s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2022 19:38
Behavioral task
behavioral1
Sample
Voice-message_MP3.jar
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Voice-message_MP3.jar
Resource
win10v2004-20221111-en
General
-
Target
Voice-message_MP3.jar
-
Size
1.6MB
-
MD5
191e73e48b19a14a907a1d3eb0daa6b3
-
SHA1
21bbbd32a3169d60fb807f2d5b08af4d1d48b71c
-
SHA256
9c336166648a6cf0a84daaf76d803245fb3103a48d7d870815ade3046d39a36b
-
SHA512
6e22fda5681b1e4b6d58ee406233eae0f1b7008ebb83cbef4f588704167d4a415da806ece8b3ccc4ad0fc6608ead2c1b7a418f25640f289073ab98971ec31b1f
-
SSDEEP
24576:pEQjxOpbjjV6eyQOU46vUu0pbFAkxw7PJe8j/pP/mIDors6M/7ClCiDGTcJy:O2xEjBxXOUDvibdxw7PJZN2IDwMDwKT5
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar family_ratty -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voice-message_MP3.jar java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 4460 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
REG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Voice-message_MP3.jar = "C:\\Users\\Admin\\AppData\\Roaming\\Voice-message_MP3.jar" REG.exe -
Modifies registry class 2 IoCs
Processes:
java.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ java.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ java.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
java.exepid process 4460 java.exe 4460 java.exe 4460 java.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
java.exedescription pid process target process PID 4460 wrote to memory of 1460 4460 java.exe REG.exe PID 4460 wrote to memory of 1460 4460 java.exe REG.exe PID 4460 wrote to memory of 1560 4460 java.exe attrib.exe PID 4460 wrote to memory of 1560 4460 java.exe attrib.exe PID 4460 wrote to memory of 2424 4460 java.exe attrib.exe PID 4460 wrote to memory of 2424 4460 java.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1560 attrib.exe 2424 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Voice-message_MP3.jar1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Voice-message_MP3.jar" /d "C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:1460
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar2⤵
- Views/modifies file attributes
PID:1560
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voice-message_MP3.jar2⤵
- Views/modifies file attributes
PID:2424
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
Filesize
1.6MB
MD5191e73e48b19a14a907a1d3eb0daa6b3
SHA121bbbd32a3169d60fb807f2d5b08af4d1d48b71c
SHA2569c336166648a6cf0a84daaf76d803245fb3103a48d7d870815ade3046d39a36b
SHA5126e22fda5681b1e4b6d58ee406233eae0f1b7008ebb83cbef4f588704167d4a415da806ece8b3ccc4ad0fc6608ead2c1b7a418f25640f289073ab98971ec31b1f