Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2023 01:59
Static task
static1
Behavioral task
behavioral1
Sample
ORDER-230278.jar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ORDER-230278.jar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Order-Specification.vbs
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Order-Specification.vbs
Resource
win10v2004-20230220-en
General
-
Target
ORDER-230278.jar
-
Size
70KB
-
MD5
a3ac8935c4feb0eef726668c1bd88498
-
SHA1
dd43d61cfdc0bcbd12c5ea4094edf8afb623b4ac
-
SHA256
7f5418868f6f347af4a7c7652e0d96b8fd2a1be9cd5c53b33265769e6210844f
-
SHA512
985f1373fbbbae84073a1853ed949898a564f1a649a25cf0ab3e89b993c47d4f978bb74b55adad1e8eba4e1bcbff3fffac9431db6a63a8bd7f4f0331bac95b6e
-
SSDEEP
1536:N1v9xQj4jxuA1gtPVfoySqawKXJ3zyse7isCW:T9G8jngt9HdqbeWQ
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230278.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\ORDER-230278 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ORDER-230278.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ORDER-230278 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\ORDER-230278.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
java.execmd.exedescription pid process target process PID 1972 wrote to memory of 648 1972 java.exe cmd.exe PID 1972 wrote to memory of 648 1972 java.exe cmd.exe PID 1972 wrote to memory of 648 1972 java.exe cmd.exe PID 1972 wrote to memory of 1416 1972 java.exe java.exe PID 1972 wrote to memory of 1416 1972 java.exe java.exe PID 1972 wrote to memory of 1416 1972 java.exe java.exe PID 648 wrote to memory of 1700 648 cmd.exe schtasks.exe PID 648 wrote to memory of 1700 648 cmd.exe schtasks.exe PID 648 wrote to memory of 1700 648 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ORDER-230278.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\ORDER-230278.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\ORDER-230278.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\ORDER-230278.jar"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ORDER-230278.jarFilesize
70KB
MD5a3ac8935c4feb0eef726668c1bd88498
SHA1dd43d61cfdc0bcbd12c5ea4094edf8afb623b4ac
SHA2567f5418868f6f347af4a7c7652e0d96b8fd2a1be9cd5c53b33265769e6210844f
SHA512985f1373fbbbae84073a1853ed949898a564f1a649a25cf0ab3e89b993c47d4f978bb74b55adad1e8eba4e1bcbff3fffac9431db6a63a8bd7f4f0331bac95b6e
-
C:\Users\Admin\AppData\Roaming\ORDER-230278.jarFilesize
70KB
MD5a3ac8935c4feb0eef726668c1bd88498
SHA1dd43d61cfdc0bcbd12c5ea4094edf8afb623b4ac
SHA2567f5418868f6f347af4a7c7652e0d96b8fd2a1be9cd5c53b33265769e6210844f
SHA512985f1373fbbbae84073a1853ed949898a564f1a649a25cf0ab3e89b993c47d4f978bb74b55adad1e8eba4e1bcbff3fffac9431db6a63a8bd7f4f0331bac95b6e
-
memory/1416-80-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/1972-63-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB