41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919

Resubmissions

18-06-2023 15:24

230618-stfkhsga79 10

18-06-2023 15:22

230618-sr1gxaga72 10

07-06-2023 11:48

230607-nyfzmahh26 7

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-06-2023 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

178.jar
Size

13.9MB
MD5

a7eeab7e2e90d0373ebfb15243bff81a
SHA1

fc32670a240a9e42ba6c453a68dec0933a85355f
SHA256

41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919
SHA512

bec9fe1bd4305326e307a9ebeb17d7e4ba3c4f0bc108e7d39c93a74faee174b762bb06a4ef7c4e04f4284c4e6c351aac249e74619d473a4539436e28a82a066f
SSDEEP

196608:pYBQXEPt5WaR6SynIRkIqZ81rI61CYYY+YA+X3vMMIYlRCu+EGlYxMrdhMTbnb:8rt5WaRRkZ81rtTidk/MMUlwmhMTLb

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

javaw.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u333-windows-i586.jar	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8u333-windows-i586.jar	javaw.exe

Loads dropped DLL 3 IoCs

Processes:

java.exejavaw.exe

pid process

4160 java.exe
856 javaw.exe
856 javaw.exe

Suspicious use of SetWindowsHookEx 36 IoCs

Processes:

java.exejavaw.exe

pid	process
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
4160	java.exe
856	javaw.exe
856	javaw.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4160 wrote to memory of 856 4160 java.exe javaw.exe
PID 4160 wrote to memory of 856 4160 java.exe javaw.exe

description	pid	process	target process
PID 4160 wrote to memory of 856	4160	java.exe	javaw.exe
PID 4160 wrote to memory of 856	4160	java.exe	javaw.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\178.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4160

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
"C:\Program Files\Java\jre1.8.0_66\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\178.jar" DELAY:3
2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
Filesize
50B

MD5
e23d477aa8e26a661e4477fa6a31d9c6

SHA1
e5f0884c1d7ff840f6ae512ad2bfa95ccd57a0b5

SHA256
a298e2bfd8a29c9b39e5ce46e3da3d221153478641aa92f409449713e9fdcd90

SHA512
bcdf2b9d9d6e5b2346b362d26811cff578ec3075df4d361ae3763266cde5286d46fdade5c0ca0776498cbb94cfafed0e30efd72d95db1bd33288d1a7fb9478df

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-1611369119000779171.x86_64.dll
Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-1611369119000779171.x86_64.dll
Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll
Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2687982009427998750.dll
Filesize
248KB

MD5
4de85f9679c3a75f6d7d3e56094aa106

SHA1
052f62fb2ebec89fbe412db480865910eab693ad

SHA256
3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

SHA512
e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1529757233-3489015626-3409890339-1000\83aa4cc77f591dfc2374580bbd95f6ba_2007c659-eb65-4631-bf41-16f7650120a3
Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/856-213-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/856-192-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/856-236-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/856-241-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/4160-193-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/4160-195-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/4160-175-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/4160-174-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/4160-143-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download
memory/4160-159-0x0000000001580000-0x0000000001581000-memory.dmp

Filesize
4KB

Download