3a00c5b808954e9dca76418506eacec9cb1cb0fd844318a896ebae787f5eaae2

Analysis

max time kernel
11s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/04/2023, 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jarfix.exe
Size

71KB
MD5

dd9f1cadb75365e4646a814e8d022010
SHA1

a963f573f3fe0422b867dabad52bd7d345ff4d49
SHA256

3a00c5b808954e9dca76418506eacec9cb1cb0fd844318a896ebae787f5eaae2
SHA512

b78415dd79a4579b97cc476c8fba9d886095c9a65967914c82b1aa6a3c3ad6dc51701692d3bea55284997124bd89dab4581b68276fe44104a089a0352b6cc986
SSDEEP

1536:EKJAES3bS2L6KbuVfmMk0DCwcOmwzYPdCHQw8TKw72lBN6dimW:3J2S2L6KbqDCwcOuPUSWu2lBN6fW

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
1672	jarfix.exe
1672	jarfix.exe
1672	jarfix.exe
1672	jarfix.exe
1672	jarfix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile	jarfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile\shell\open\command	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.JAR	jarfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File"	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JARFILE\SHELL\OPEN\COMMAND	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"%1\" %*"	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile"	jarfix.exe

C:\Users\Admin\AppData\Local\Temp\jarfix.exe
"C:\Users\Admin\AppData\Local\Temp\jarfix.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\System.dll

Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\UserInfo.dll

Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\UserInfo.dll

Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\UserInfo.dll

Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\UserInfo.dll

Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsuAC63.tmp\UserInfo.dll

Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit