Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2023 14:22
Static task
static1
Behavioral task
behavioral1
Sample
Solicituddecotizacin23062.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Solicituddecotizacin23062.jar
Resource
win10v2004-20230621-en
General
-
Target
Solicituddecotizacin23062.jar
-
Size
218KB
-
MD5
aaffc5262ba30e3ea20e6195f39d021a
-
SHA1
93e3c3e08b0ba58374957299a74b68155e4f334f
-
SHA256
5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
-
SHA512
0308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
SSDEEP
6144:NhfBco5zzHNroaMYWIsXwKH3gpQQ89+dny:jOEzNcalODH3VQ8z
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicituddecotizacin23062.jar java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid Process 4812 java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicituddecotizacin23062 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicituddecotizacin23062.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicituddecotizacin23062 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicituddecotizacin23062.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 53 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid Process Token: SeIncreaseQuotaPrivilege 3600 WMIC.exe Token: SeSecurityPrivilege 3600 WMIC.exe Token: SeTakeOwnershipPrivilege 3600 WMIC.exe Token: SeLoadDriverPrivilege 3600 WMIC.exe Token: SeSystemProfilePrivilege 3600 WMIC.exe Token: SeSystemtimePrivilege 3600 WMIC.exe Token: SeProfSingleProcessPrivilege 3600 WMIC.exe Token: SeIncBasePriorityPrivilege 3600 WMIC.exe Token: SeCreatePagefilePrivilege 3600 WMIC.exe Token: SeBackupPrivilege 3600 WMIC.exe Token: SeRestorePrivilege 3600 WMIC.exe Token: SeShutdownPrivilege 3600 WMIC.exe Token: SeDebugPrivilege 3600 WMIC.exe Token: SeSystemEnvironmentPrivilege 3600 WMIC.exe Token: SeRemoteShutdownPrivilege 3600 WMIC.exe Token: SeUndockPrivilege 3600 WMIC.exe Token: SeManageVolumePrivilege 3600 WMIC.exe Token: 33 3600 WMIC.exe Token: 34 3600 WMIC.exe Token: 35 3600 WMIC.exe Token: 36 3600 WMIC.exe Token: SeIncreaseQuotaPrivilege 3600 WMIC.exe Token: SeSecurityPrivilege 3600 WMIC.exe Token: SeTakeOwnershipPrivilege 3600 WMIC.exe Token: SeLoadDriverPrivilege 3600 WMIC.exe Token: SeSystemProfilePrivilege 3600 WMIC.exe Token: SeSystemtimePrivilege 3600 WMIC.exe Token: SeProfSingleProcessPrivilege 3600 WMIC.exe Token: SeIncBasePriorityPrivilege 3600 WMIC.exe Token: SeCreatePagefilePrivilege 3600 WMIC.exe Token: SeBackupPrivilege 3600 WMIC.exe Token: SeRestorePrivilege 3600 WMIC.exe Token: SeShutdownPrivilege 3600 WMIC.exe Token: SeDebugPrivilege 3600 WMIC.exe Token: SeSystemEnvironmentPrivilege 3600 WMIC.exe Token: SeRemoteShutdownPrivilege 3600 WMIC.exe Token: SeUndockPrivilege 3600 WMIC.exe Token: SeManageVolumePrivilege 3600 WMIC.exe Token: 33 3600 WMIC.exe Token: 34 3600 WMIC.exe Token: 35 3600 WMIC.exe Token: 36 3600 WMIC.exe Token: SeIncreaseQuotaPrivilege 4484 WMIC.exe Token: SeSecurityPrivilege 4484 WMIC.exe Token: SeTakeOwnershipPrivilege 4484 WMIC.exe Token: SeLoadDriverPrivilege 4484 WMIC.exe Token: SeSystemProfilePrivilege 4484 WMIC.exe Token: SeSystemtimePrivilege 4484 WMIC.exe Token: SeProfSingleProcessPrivilege 4484 WMIC.exe Token: SeIncBasePriorityPrivilege 4484 WMIC.exe Token: SeCreatePagefilePrivilege 4484 WMIC.exe Token: SeBackupPrivilege 4484 WMIC.exe Token: SeRestorePrivilege 4484 WMIC.exe Token: SeShutdownPrivilege 4484 WMIC.exe Token: SeDebugPrivilege 4484 WMIC.exe Token: SeSystemEnvironmentPrivilege 4484 WMIC.exe Token: SeRemoteShutdownPrivilege 4484 WMIC.exe Token: SeUndockPrivilege 4484 WMIC.exe Token: SeManageVolumePrivilege 4484 WMIC.exe Token: 33 4484 WMIC.exe Token: 34 4484 WMIC.exe Token: 35 4484 WMIC.exe Token: 36 4484 WMIC.exe Token: SeIncreaseQuotaPrivilege 4484 WMIC.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
java.exejava.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 2228 wrote to memory of 1268 2228 java.exe 87 PID 2228 wrote to memory of 1268 2228 java.exe 87 PID 1268 wrote to memory of 3588 1268 java.exe 91 PID 1268 wrote to memory of 3588 1268 java.exe 91 PID 1268 wrote to memory of 4812 1268 java.exe 93 PID 1268 wrote to memory of 4812 1268 java.exe 93 PID 3588 wrote to memory of 4336 3588 cmd.exe 95 PID 3588 wrote to memory of 4336 3588 cmd.exe 95 PID 4812 wrote to memory of 1028 4812 java.exe 96 PID 4812 wrote to memory of 1028 4812 java.exe 96 PID 1028 wrote to memory of 3600 1028 cmd.exe 98 PID 1028 wrote to memory of 3600 1028 cmd.exe 98 PID 4812 wrote to memory of 4884 4812 java.exe 99 PID 4812 wrote to memory of 4884 4812 java.exe 99 PID 4884 wrote to memory of 4484 4884 cmd.exe 101 PID 4884 wrote to memory of 4484 4884 cmd.exe 101 PID 4812 wrote to memory of 2512 4812 java.exe 102 PID 4812 wrote to memory of 2512 4812 java.exe 102 PID 2512 wrote to memory of 4904 2512 cmd.exe 104 PID 2512 wrote to memory of 4904 2512 cmd.exe 104 PID 4812 wrote to memory of 3436 4812 java.exe 105 PID 4812 wrote to memory of 3436 4812 java.exe 105 PID 3436 wrote to memory of 4088 3436 cmd.exe 107 PID 3436 wrote to memory of 4088 3436 cmd.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Solicituddecotizacin23062.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\Solicituddecotizacin23062.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"3⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"4⤵
- Creates scheduled task(s)
PID:4336
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list5⤵PID:4904
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"4⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list5⤵PID:4088
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD565aee4066939515aa36c3943711b210d
SHA1547528b3863a1d1b0b6d79cd81ecbc1342d84dc7
SHA256af525007a1d3ead1832a74a9212306d67aba43029d59655b96926c8200775b2c
SHA51241fe21cad7b11e75e6a4854383cefe7f10147daf76e306406cb955fafedcffb39e85af38eaa904c093ba8249420ba1eb9181d3fd61db3e478c3dec1f0f0e0a45
-
Filesize
50B
MD5bfd921922da174d9f2ccae09c376c5c3
SHA1e22000521cd8e83febd3680c059ff3ce1d317999
SHA256cc01c2ebdbb7894234c32713b1625bf61cbfc473bb23b3d08858e13514a990d6
SHA512bf7f30802e0b87dca9d175a31ee1489ee478c9bd54c567e0b6b89f524079cbcd52bdfcf9c41648a1ec0152e018ab83b85589666db2751b4440bca25cc4d38c43
-
Filesize
241KB
MD5e02979ecd43bcc9061eb2b494ab5af50
SHA13122ac0e751660f646c73b10c4f79685aa65c545
SHA256a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a
SHA5121e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-508929744-1894537824-211734425-1000\83aa4cc77f591dfc2374580bbd95f6ba_3db77c8d-8b44-4cdd-80bd-b67b97edf7a0
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d
-
Filesize
218KB
MD5aaffc5262ba30e3ea20e6195f39d021a
SHA193e3c3e08b0ba58374957299a74b68155e4f334f
SHA2565c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
SHA5120308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893
-
Filesize
1.4MB
MD5acfb5b5fd9ee10bf69497792fd469f85
SHA10e0845217c4907822403912ad6828d8e0b256208
SHA256b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e
SHA512e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa
-
Filesize
2.6MB
MD52f4a99c2758e72ee2b59a73586a2322f
SHA1af38e7c4d0fc73c23ecd785443705bfdee5b90bf
SHA25624d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5
SHA512b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494
-
Filesize
4.1MB
MD5b33387e15ab150a7bf560abdc73c3bec
SHA166b8075784131f578ef893fd7674273f709b9a4c
SHA2562eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491
SHA51225cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279
-
Filesize
772KB
MD5e1aa38a1e78a76a6de73efae136cdb3a
SHA1c463da71871f780b2e2e5dba115d43953b537daf
SHA2562ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609
SHA512fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d