Analysis

  • max time kernel
    18s
  • max time network
    68s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-12-2022 19:38

General

  • Target

    Voice-message_MP3.jar

  • Size

    1.6MB

  • MD5

    191e73e48b19a14a907a1d3eb0daa6b3

  • SHA1

    21bbbd32a3169d60fb807f2d5b08af4d1d48b71c

  • SHA256

    9c336166648a6cf0a84daaf76d803245fb3103a48d7d870815ade3046d39a36b

  • SHA512

    6e22fda5681b1e4b6d58ee406233eae0f1b7008ebb83cbef4f588704167d4a415da806ece8b3ccc4ad0fc6608ead2c1b7a418f25640f289073ab98971ec31b1f

  • SSDEEP

    24576:pEQjxOpbjjV6eyQOU46vUu0pbFAkxw7PJe8j/pP/mIDors6M/7ClCiDGTcJy:O2xEjBxXOUDvibdxw7PJZN2IDwMDwKT5

Malware Config

Signatures

  • Ratty

    Ratty is an open source Java Remote Access Tool.

  • Ratty Rat payload 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Voice-message_MP3.jar
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\SYSTEM32\REG.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Voice-message_MP3.jar" /d "C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1460
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar
      2⤵
      • Views/modifies file attributes
      PID:1560
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Voice-message_MP3.jar
      2⤵
      • Views/modifies file attributes
      PID:2424

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll

    Filesize

    83KB

    MD5

    55f4de7f270663b3dc712b8c9eed422a

    SHA1

    7432773eb4d09dc286d43fcc77ddb0e1e3bce2b4

    SHA256

    47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25

    SHA512

    9da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996

  • C:\Users\Admin\AppData\Roaming\Voice-message_MP3.jar

    Filesize

    1.6MB

    MD5

    191e73e48b19a14a907a1d3eb0daa6b3

    SHA1

    21bbbd32a3169d60fb807f2d5b08af4d1d48b71c

    SHA256

    9c336166648a6cf0a84daaf76d803245fb3103a48d7d870815ade3046d39a36b

    SHA512

    6e22fda5681b1e4b6d58ee406233eae0f1b7008ebb83cbef4f588704167d4a415da806ece8b3ccc4ad0fc6608ead2c1b7a418f25640f289073ab98971ec31b1f

  • memory/1460-148-0x0000000000000000-mapping.dmp

  • memory/1560-149-0x0000000000000000-mapping.dmp

  • memory/2424-150-0x0000000000000000-mapping.dmp

  • memory/4460-151-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-162-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-164-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-136-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-171-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-178-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-183-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-184-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-187-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-189-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-190-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-191-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB

  • memory/4460-192-0x0000000002670000-0x0000000003670000-memory.dmp

    Filesize

    16.0MB