41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919

Resubmissions

18-06-2023 15:24

230618-stfkhsga79 10

18-06-2023 15:22

230618-sr1gxaga72 10

07-06-2023 11:48

230607-nyfzmahh26 7

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20230220-de
resource tags

arch:x64arch:x86image:win10v2004-20230220-delocale:de-deos:windows10-2004-x64systemwindows
submitted
07-06-2023 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178.jar
Size

13.9MB
MD5

a7eeab7e2e90d0373ebfb15243bff81a
SHA1

fc32670a240a9e42ba6c453a68dec0933a85355f
SHA256

41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919
SHA512

bec9fe1bd4305326e307a9ebeb17d7e4ba3c4f0bc108e7d39c93a74faee174b762bb06a4ef7c4e04f4284c4e6c351aac249e74619d473a4539436e28a82a066f
SSDEEP

196608:pYBQXEPt5WaR6SynIRkIqZ81rI61CYYY+YA+X3vMMIYlRCu+EGlYxMrdhMTbnb:8rt5WaRRkZ81rtTidk/MMUlwmhMTLb

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

javaw.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u333-windows-i586.jar	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u333-windows-i586.jar	javaw.exe

Loads dropped DLL 3 IoCs

Processes:

java.exejavaw.exe

pid process

4060 java.exe
3528 javaw.exe
3528 javaw.exe
Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

java.exejavaw.exe

pid process

4060 java.exe
4060 java.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe
3528 javaw.exe

pid	process
4060	java.exe
3528	javaw.exe
3528	javaw.exe

pid	process
4060	java.exe
4060	java.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe
3528	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

java.exejavaw.exe

description	pid	process	target process
PID 4060 wrote to memory of 3528	4060	java.exe	javaw.exe
PID 4060 wrote to memory of 3528	4060	java.exe	javaw.exe
PID 3528 wrote to memory of 1500	3528	javaw.exe	netsh.exe
PID 3528 wrote to memory of 1500	3528	javaw.exe	netsh.exe
PID 3528 wrote to memory of 2096	3528	javaw.exe	netsh.exe
PID 3528 wrote to memory of 2096	3528	javaw.exe	netsh.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\178.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
  "C:\Program Files\Java\jre1.8.0_66\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\178.jar" DELAY:3
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:1500
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    PID:2096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

Filesize
50B

MD5
2a120c1b2cb9d6f85256c89e97c4fc66

SHA1
f0b61b608889725a8cc4aac1965ad79d500b9a3e

SHA256
92e1d8819e951dc23a153b1ebce5348f0da61b7e15f2ea3a9fdfb5eea969e8d1

SHA512
f155bc184408bdd44903c60b6a292d681a529ecb60c3d512fdadb4fb480d7d219ec443043a57f4534f7ad5ab42e01bddfbab7cb5f200dceea92df136e50923a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-8634536811673657551.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-8634536811673657551.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna1143465518461638433.dll

Filesize
248KB

MD5
4de85f9679c3a75f6d7d3e56094aa106

SHA1
052f62fb2ebec89fbe412db480865910eab693ad

SHA256
3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

SHA512
e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1675742406-747946869-1029867430-1000\83aa4cc77f591dfc2374580bbd95f6ba_8d6935fa-0795-4a6f-bfd9-e755f1917fa0

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/3528-192-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-176-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-187-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-191-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-214-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-217-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-253-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3528-264-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/4060-171-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4060-159-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4060-143-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/4060-155-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download