Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2023 14:18
Static task
static1
Behavioral task
behavioral1
Sample
InSeNaCoder1550ddc8jar.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
InSeNaCoder1550ddc8jar.jar
Resource
win10v2004-20230621-en
General
-
Target
InSeNaCoder1550ddc8jar.jar
-
Size
218KB
-
MD5
d46ced619302d537e07481dfe8a1e7e1
-
SHA1
135311ed819821a8a5043a0141c192e7b121a459
-
SHA256
4e0f0e48af90b53ca2f5bfe07730901ca963655051f5fd4fba455933bc9a72ec
-
SHA512
e4a35e5868ab5d267165375093a929ed02fc00b1fa6d9ef6e922c2992347363727b4c3ec935cf0562a600bbb5d571033e1e849ed5c12fc87915e2c2f0e605911
-
SSDEEP
6144:UgYgkGYzGvr/s2tpIg5+YagSKH2KDUsI9:UgYWQEIgoYtSQ2Kgx9
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InSeNaCoder1550ddc8jar.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-922299981-3641064733-3870770889-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InSeNaCoder1550ddc8jar = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\InSeNaCoder1550ddc8jar.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InSeNaCoder1550ddc8jar = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\InSeNaCoder1550ddc8jar.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
java.exejava.exedescription pid Process procid_target PID 892 wrote to memory of 4708 892 java.exe 85 PID 892 wrote to memory of 4708 892 java.exe 85 PID 4708 wrote to memory of 2352 4708 java.exe 87 PID 4708 wrote to memory of 2352 4708 java.exe 87 PID 4708 wrote to memory of 3224 4708 java.exe 89 PID 4708 wrote to memory of 3224 4708 java.exe 89
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\InSeNaCoder1550ddc8jar.jar1⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\InSeNaCoder1550ddc8jar.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\InSeNaCoder1550ddc8jar.jar"3⤵PID:2352
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\InSeNaCoder1550ddc8jar.jar"4⤵
- Creates scheduled task(s)
PID:3604
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\InSeNaCoder1550ddc8jar.jar"3⤵PID:3224
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD500a5015b5f42cfd90258225fd4cb8432
SHA11bf757f10eef4710c63782fb89c7aa120d469003
SHA256ebffd495b0e5e220a83a3c31859b234a9fdee1215a8e062d828798f3a620f276
SHA512b3dcae5730376cf266bb7fe45887b3e3f5e934669d6dfa770a18c4df9f5ecc99eecbfe21106524aac17dba808f393a1920bd7658fbc5ebd3eb170f307d68e773
-
Filesize
218KB
MD5d46ced619302d537e07481dfe8a1e7e1
SHA1135311ed819821a8a5043a0141c192e7b121a459
SHA2564e0f0e48af90b53ca2f5bfe07730901ca963655051f5fd4fba455933bc9a72ec
SHA512e4a35e5868ab5d267165375093a929ed02fc00b1fa6d9ef6e922c2992347363727b4c3ec935cf0562a600bbb5d571033e1e849ed5c12fc87915e2c2f0e605911
-
Filesize
218KB
MD5d46ced619302d537e07481dfe8a1e7e1
SHA1135311ed819821a8a5043a0141c192e7b121a459
SHA2564e0f0e48af90b53ca2f5bfe07730901ca963655051f5fd4fba455933bc9a72ec
SHA512e4a35e5868ab5d267165375093a929ed02fc00b1fa6d9ef6e922c2992347363727b4c3ec935cf0562a600bbb5d571033e1e849ed5c12fc87915e2c2f0e605911
-
Filesize
218KB
MD5d46ced619302d537e07481dfe8a1e7e1
SHA1135311ed819821a8a5043a0141c192e7b121a459
SHA2564e0f0e48af90b53ca2f5bfe07730901ca963655051f5fd4fba455933bc9a72ec
SHA512e4a35e5868ab5d267165375093a929ed02fc00b1fa6d9ef6e922c2992347363727b4c3ec935cf0562a600bbb5d571033e1e849ed5c12fc87915e2c2f0e605911
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d