Resubmissions
18/06/2023, 15:24
230618-stfkhsga79 1018/06/2023, 15:22
230618-sr1gxaga72 1007/06/2023, 11:48
230607-nyfzmahh26 7Analysis
-
max time kernel
201s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
18/06/2023, 15:24
General
-
Target
178.jar
-
Size
13.9MB
-
MD5
a7eeab7e2e90d0373ebfb15243bff81a
-
SHA1
fc32670a240a9e42ba6c453a68dec0933a85355f
-
SHA256
41a037f09bf41b5cb1ca453289e6ca961d61cd96eeefb1b5bbf153612396d919
-
SHA512
bec9fe1bd4305326e307a9ebeb17d7e4ba3c4f0bc108e7d39c93a74faee174b762bb06a4ef7c4e04f4284c4e6c351aac249e74619d473a4539436e28a82a066f
-
SSDEEP
196608:pYBQXEPt5WaR6SynIRkIqZ81rI61CYYY+YA+X3vMMIYlRCu+EGlYxMrdhMTbnb:8rt5WaRRkZ81rtTidk/MMUlwmhMTLb
Malware Config
Signatures
-
Drops startup file 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\178.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\178.jar" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5ab5706066d4d6a51e288d01660c2fb19
SHA1c778fc9889bdc5cd62e0be3b296951bfc808155f
SHA256bf9aa4462aec9f142383ef90c67e7f44d1ec0125cb7b02e689dd7f762c029333
SHA51203a85ad2ebf51697d0d12b5682b88622dee2c45e071e2a81d804bc8cb20d62c03ff6cc43e96a2751412d44f0b48d85f11cdfd9af57d693e11c43247cf8367803
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
80KB
MD5e9a449971b9efb0a2e12b9cfdd95c076
SHA1385777659fa84e94a3812eb9a8afad27ae3ceed4
SHA256b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18
SHA512bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d
-
Filesize
248KB
MD54de85f9679c3a75f6d7d3e56094aa106
SHA1052f62fb2ebec89fbe412db480865910eab693ad
SHA2563d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc
SHA512e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab
-
Filesize
45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB