Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2023 01:49
Static task
static1
Behavioral task
behavioral1
Sample
Inventory List.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Inventory List.jar
Resource
win10v2004-20230621-en
General
-
Target
Inventory List.jar
-
Size
219KB
-
MD5
4528ca1cd5111138dbd966f65aa18fd4
-
SHA1
51288703a62480e7a80fc6e2f43d96f230324537
-
SHA256
924c2bc4af402c80d0d9840cb97ced94cf09755df952c02f43d0f23b5f6ed657
-
SHA512
7a45b93c648bdda6b42853face3e41f39ae057aa136af0d664bb31c8f8e09d4ab8534e15d833f8dfacad3b6bb538343dd942855ed3f9b7010691ffef4db9077c
-
SSDEEP
6144:j0BJ66R8sBvhIm5ETEXBr/8D9b1WbhjPf7jtjCi:vUB5bGSSZyjfAi
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Inventory List.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Inventory List = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Inventory List.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Inventory List = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Inventory List.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.exejava.execmd.exedescription pid Process procid_target PID 2660 wrote to memory of 912 2660 java.exe 79 PID 2660 wrote to memory of 912 2660 java.exe 79 PID 912 wrote to memory of 3880 912 java.exe 81 PID 912 wrote to memory of 3880 912 java.exe 81 PID 912 wrote to memory of 4968 912 java.exe 83 PID 912 wrote to memory of 4968 912 java.exe 83 PID 3880 wrote to memory of 3516 3880 cmd.exe 85 PID 3880 wrote to memory of 3516 3880 cmd.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Inventory List.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\Inventory List.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Inventory List.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Inventory List.jar"4⤵
- Creates scheduled task(s)
PID:3516
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Inventory List.jar"3⤵PID:4968
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD540036d860061e8d2bfb840a957e12e14
SHA1e42df3b81f8765c4efe63e88ec85b0cd7b6a8bf5
SHA256c60d28e9968b968dc73700f9d81b0b278468d6eac98c7adefb5a9a42ccd85439
SHA5128f5feebdb7373472c98d1fe2145779425ce2d2238c22c23212e76bf083d55c424a78d3ca5e80d8d732e0a493412a952875bda5fd81b6d77ffd78b97afeecfc96
-
Filesize
219KB
MD54528ca1cd5111138dbd966f65aa18fd4
SHA151288703a62480e7a80fc6e2f43d96f230324537
SHA256924c2bc4af402c80d0d9840cb97ced94cf09755df952c02f43d0f23b5f6ed657
SHA5127a45b93c648bdda6b42853face3e41f39ae057aa136af0d664bb31c8f8e09d4ab8534e15d833f8dfacad3b6bb538343dd942855ed3f9b7010691ffef4db9077c
-
Filesize
219KB
MD54528ca1cd5111138dbd966f65aa18fd4
SHA151288703a62480e7a80fc6e2f43d96f230324537
SHA256924c2bc4af402c80d0d9840cb97ced94cf09755df952c02f43d0f23b5f6ed657
SHA5127a45b93c648bdda6b42853face3e41f39ae057aa136af0d664bb31c8f8e09d4ab8534e15d833f8dfacad3b6bb538343dd942855ed3f9b7010691ffef4db9077c
-
Filesize
219KB
MD54528ca1cd5111138dbd966f65aa18fd4
SHA151288703a62480e7a80fc6e2f43d96f230324537
SHA256924c2bc4af402c80d0d9840cb97ced94cf09755df952c02f43d0f23b5f6ed657
SHA5127a45b93c648bdda6b42853face3e41f39ae057aa136af0d664bb31c8f8e09d4ab8534e15d833f8dfacad3b6bb538343dd942855ed3f9b7010691ffef4db9077c
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d