Analysis
-
max time kernel
126s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-01-2023 17:40
Behavioral task
behavioral1
Sample
TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar
Resource
win10v2004-20220901-en
General
-
Target
TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar
-
Size
764KB
-
MD5
de926a705c02c29aec3a34162c76fa0b
-
SHA1
ce830780086bf326e2d62a7d59d37349f32f0ba3
-
SHA256
4ed2ca0a64bc9f7c114d1a91ae0f0e946a5e32d30fca791123bbf3043befec4e
-
SHA512
02a776c4040e72def12c5c1b588153693a89ccf583ebf4bcde628222967aaa0aa101e70ec5db679f5ee27d010cabfc2d040f64800f4047502cd51f9528ceaa2e
-
SSDEEP
12288:vClCR+jp42GLRhJ7ar5jU75XGC+g73MJ9GaXvf/g9QLK/OFRu+P5084ZpEPPTLiF:vClCeBGLorJQhN+W8JFXvf49QLCO6+No
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule behavioral2/files/0x0004000000022da0-145.dat family_ratty -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid Process 3548 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
REG.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar = "C:\\Users\\Admin\\AppData\\Roaming\\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar" REG.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe -
Modifies registry class 2 IoCs
Processes:
java.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ java.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ java.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
java.exepid Process 3548 java.exe 3548 java.exe 3548 java.exe 3548 java.exe 3548 java.exe 3548 java.exe 3548 java.exe 3548 java.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
java.exedescription pid Process procid_target PID 3548 wrote to memory of 2868 3548 java.exe 81 PID 3548 wrote to memory of 2868 3548 java.exe 81 PID 3548 wrote to memory of 1576 3548 java.exe 83 PID 3548 wrote to memory of 1576 3548 java.exe 83 PID 3548 wrote to memory of 3668 3548 java.exe 86 PID 3548 wrote to memory of 3668 3548 java.exe 86 -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 1576 attrib.exe 3668 attrib.exe
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar" /d "C:\Users\Admin\AppData\Roaming\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
PID:2868
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar2⤵
- Views/modifies file attributes
PID:1576
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TtLKCmS8n3wRTRqRrg8OlGpeMtMPynkRI7vzBDvv7E4.jar2⤵
- Views/modifies file attributes
PID:3668
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
Filesize
764KB
MD5de926a705c02c29aec3a34162c76fa0b
SHA1ce830780086bf326e2d62a7d59d37349f32f0ba3
SHA2564ed2ca0a64bc9f7c114d1a91ae0f0e946a5e32d30fca791123bbf3043befec4e
SHA51202a776c4040e72def12c5c1b588153693a89ccf583ebf4bcde628222967aaa0aa101e70ec5db679f5ee27d010cabfc2d040f64800f4047502cd51f9528ceaa2e