Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2023 12:09
Static task
static1
Behavioral task
behavioral1
Sample
Solicitud de cotización #230627.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Solicitud de cotización #230627.jar
Resource
win10v2004-20230621-en
General
-
Target
Solicitud de cotización #230627.jar
-
Size
218KB
-
MD5
aaffc5262ba30e3ea20e6195f39d021a
-
SHA1
93e3c3e08b0ba58374957299a74b68155e4f334f
-
SHA256
5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
-
SHA512
0308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
SSDEEP
6144:NhfBco5zzHNroaMYWIsXwKH3gpQQ89+dny:jOEzNcalODH3VQ8z
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicitud de cotización #230627.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitud de cotización #230627 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitud de cotización #230627.jar\"" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-4129409437-3162877118-52503038-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicitud de cotización #230627 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicitud de cotización #230627.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.exejava.execmd.exedescription pid Process procid_target PID 5024 wrote to memory of 4560 5024 java.exe 86 PID 5024 wrote to memory of 4560 5024 java.exe 86 PID 4560 wrote to memory of 2948 4560 java.exe 88 PID 4560 wrote to memory of 2948 4560 java.exe 88 PID 4560 wrote to memory of 2216 4560 java.exe 89 PID 4560 wrote to memory of 2216 4560 java.exe 89 PID 2948 wrote to memory of 732 2948 cmd.exe 92 PID 2948 wrote to memory of 732 2948 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Solicitud de cotización #230627.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\Solicitud de cotización #230627.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicitud de cotización #230627.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicitud de cotización #230627.jar"4⤵
- Creates scheduled task(s)
PID:732
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Solicitud de cotización #230627.jar"3⤵PID:2216
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD555471cd3e6adcb3957c55be9362e0702
SHA1f45d299bfaebead34004d4a94ffea56a909e6ed5
SHA25696b0cdd7c747d732a25c39e9460b17dcd565dba3e67622ea8d0b5d5555682410
SHA512a93031d1cd988905836231fd2ca2ac7225dca0afadf9ca4d83bd94074d8825b25c93808912b8bf9fc59d03ab7c365307a326b7570bd760b59c0b4ead64532605
-
Filesize
50B
MD597e26b33e6130843ecd36661d75bb78c
SHA15672262f7928a592fbb740b90a1a3a8676fa1ec2
SHA2567bb1b0e056ab6daf38c562fba077058b42270832c60dcf5b71a3ecf5bb7441fe
SHA512c7bdb08aeaf76edad190271ef83dd45d8163775d7a044741e56ed36c720ddf6a6baf29fe03684a071f0c0b2d12e56d73f22cce970b63ab2809ad0d6143764092
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4129409437-3162877118-52503038-1000\83aa4cc77f591dfc2374580bbd95f6ba_b7c2c17f-d18f-4e40-8a8c-2e93d1960e8a
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d