8ef4fa7bb16ed5d984867c715d54fd90f247359a8bbcdaec55e8dd71f847390b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2023, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

auz.jar
Size

34KB
MD5

c931fe86bf37ea43b5f7e960911442a6
SHA1

3553f2f69a969c9166a9d62ad99c5ff76414ca58
SHA256

b684a92d13f4b0b08722b1c3046b94de66e5dc249991137cedb81c65bbe24f40
SHA512

64aa0bc66d37793b8922285d70c7f2d27f0b9cc668ec67ec48f7a2523024ea82c4f41397a39644937032fa8c67678e3bbe23f1dc1aae2a9ddbcca4db4e9725e2
SSDEEP

768:C3d1fq+qbt5dnsn8UNsMbbjY6IoSxs35pyWY1ul6ilLF7OAWOv/Z2vV/N0Oil:C3ChlUeMbbE5epsDusi77DW8/IVSpl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\106df4 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar C:\\Users\\Admin\\AppData\\Roaming\\106df4\\106df453587cc0b6022794a727aa5bab.log"	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4896	4588	java.exe	91
PID 4588 wrote to memory of 4896	4588	java.exe	91

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\auz.jar
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKU\S-1-5-19"
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4588-147-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/4588-157-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download