Analysis Overview
SHA256
5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109
Threat Level: Known bad
The file Solicituddecotizacin23062.jar was found to be: Known bad.
Malicious Activity Summary
STRRAT
Drops startup file
Loads dropped DLL
Looks up external IP address via web service
Adds Run key to start application
Uses Task Scheduler COM API
Creates scheduled task(s)
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-06-27 14:22
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-06-27 14:22
Reported
2023-06-27 14:25
Platform
win7-20230621-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
Processes
C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Solicituddecotizacin23062.jar
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | repo1.maven.org | udp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | github.com | tcp |
| US | 140.82.113.3:443 | tcp |
Files
memory/1724-63-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-70-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-72-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-74-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-80-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-81-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-82-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1724-91-0x0000000000220000-0x0000000000221000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-06-27 14:22
Reported
2023-06-27 14:25
Platform
win10v2004-20230621-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
STRRAT
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Solicituddecotizacin23062.jar | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicituddecotizacin23062 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicituddecotizacin23062.jar\"" | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Solicituddecotizacin23062 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Solicituddecotizacin23062.jar\"" | C:\Program Files\Java\jre1.8.0_66\bin\java.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeTakeOwnershipPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeLoadDriverPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemProfilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemtimePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeProfSingleProcessPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncBasePriorityPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeBackupPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRestorePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeUndockPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeManageVolumePrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 33 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 34 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 35 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: 36 | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Windows\System32\Wbem\WMIC.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Solicituddecotizacin23062.jar
C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\Solicituddecotizacin23062.jar"
C:\Windows\SYSTEM32\cmd.exe
cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"
C:\Program Files\Java\jre1.8.0_66\bin\java.exe
"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"
C:\Windows\system32\schtasks.exe
schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar"
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
C:\Windows\System32\Wbem\WMIC.exe
wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
C:\Windows\System32\Wbem\WMIC.exe
wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
C:\Windows\System32\Wbem\WMIC.exe
wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
C:\Windows\System32\Wbem\WMIC.exe
wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 8.8.8.8:53 | repo1.maven.org | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 199.232.192.209:443 | repo1.maven.org | tcp |
| US | 140.82.112.4:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.111.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 4.112.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.192.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.8.109.52.in-addr.arpa | udp |
| US | 209.197.3.8:80 | tcp | |
| GB | 96.16.110.41:443 | tcp | |
| US | 8.8.8.8:53 | bmh-global.myfirewall.org | udp |
| NL | 45.12.253.130:5580 | bmh-global.myfirewall.org | tcp |
| US | 8.8.8.8:53 | 130.253.12.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
Files
memory/2228-147-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-161-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-174-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-179-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-180-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-181-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-188-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-191-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-196-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-197-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2228-202-0x00000000026F0000-0x00000000026F1000-memory.dmp
C:\Users\Admin\Solicituddecotizacin23062.jar
| MD5 | aaffc5262ba30e3ea20e6195f39d021a |
| SHA1 | 93e3c3e08b0ba58374957299a74b68155e4f334f |
| SHA256 | 5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109 |
| SHA512 | 0308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893 |
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | 65aee4066939515aa36c3943711b210d |
| SHA1 | 547528b3863a1d1b0b6d79cd81ecbc1342d84dc7 |
| SHA256 | af525007a1d3ead1832a74a9212306d67aba43029d59655b96926c8200775b2c |
| SHA512 | 41fe21cad7b11e75e6a4854383cefe7f10147daf76e306406cb955fafedcffb39e85af38eaa904c093ba8249420ba1eb9181d3fd61db3e478c3dec1f0f0e0a45 |
C:\Users\Admin\lib\system-hook-3.5.jar
| MD5 | e1aa38a1e78a76a6de73efae136cdb3a |
| SHA1 | c463da71871f780b2e2e5dba115d43953b537daf |
| SHA256 | 2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609 |
| SHA512 | fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d |
C:\Users\Admin\lib\jna-5.5.0.jar
| MD5 | acfb5b5fd9ee10bf69497792fd469f85 |
| SHA1 | 0e0845217c4907822403912ad6828d8e0b256208 |
| SHA256 | b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e |
| SHA512 | e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa |
C:\Users\Admin\lib\jna-platform-5.5.0.jar
| MD5 | 2f4a99c2758e72ee2b59a73586a2322f |
| SHA1 | af38e7c4d0fc73c23ecd785443705bfdee5b90bf |
| SHA256 | 24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5 |
| SHA512 | b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494 |
C:\Users\Admin\lib\sqlite-jdbc-3.14.2.1.jar
| MD5 | b33387e15ab150a7bf560abdc73c3bec |
| SHA1 | 66b8075784131f578ef893fd7674273f709b9a4c |
| SHA256 | 2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491 |
| SHA512 | 25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279 |
memory/1268-218-0x00000000015E0000-0x00000000015E1000-memory.dmp
memory/1268-220-0x00000000015E0000-0x00000000015E1000-memory.dmp
C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar
| MD5 | aaffc5262ba30e3ea20e6195f39d021a |
| SHA1 | 93e3c3e08b0ba58374957299a74b68155e4f334f |
| SHA256 | 5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109 |
| SHA512 | 0308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893 |
C:\Users\Admin\AppData\Roaming\Solicituddecotizacin23062.jar
| MD5 | aaffc5262ba30e3ea20e6195f39d021a |
| SHA1 | 93e3c3e08b0ba58374957299a74b68155e4f334f |
| SHA256 | 5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109 |
| SHA512 | 0308fbff4d6e3cf0dfd9ad8533ea254913817066b239fbb75b8b529b3ae4952c5a561895974bf801682995b8eda0f9dacc82683162ff2e6aa62592c9e6654893 |
C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp
| MD5 | bfd921922da174d9f2ccae09c376c5c3 |
| SHA1 | e22000521cd8e83febd3680c059ff3ce1d317999 |
| SHA256 | cc01c2ebdbb7894234c32713b1625bf61cbfc473bb23b3d08858e13514a990d6 |
| SHA512 | bf7f30802e0b87dca9d175a31ee1489ee478c9bd54c567e0b6b89f524079cbcd52bdfcf9c41648a1ec0152e018ab83b85589666db2751b4440bca25cc4d38c43 |
C:\Users\Admin\AppData\Roaming\lib\system-hook-3.5.jar
| MD5 | e1aa38a1e78a76a6de73efae136cdb3a |
| SHA1 | c463da71871f780b2e2e5dba115d43953b537daf |
| SHA256 | 2ddda8af6faef8bde46acf43ec546603180bcf8dcb2e5591fff8ac9cd30b5609 |
| SHA512 | fee16fe9364926ec337e52f551fd62ed81984808a847de2fd68ff29b6c5da0dcc04ef6d8977f0fe675662a7d2ea1065cdcdd2a5259446226a7c7c5516bd7d60d |
C:\Users\Admin\AppData\Roaming\lib\jna-5.5.0.jar
| MD5 | acfb5b5fd9ee10bf69497792fd469f85 |
| SHA1 | 0e0845217c4907822403912ad6828d8e0b256208 |
| SHA256 | b308faebfe4ed409de8410e0a632d164b2126b035f6eacff968d3908cafb4d9e |
| SHA512 | e52575f58a195ceb3bd16b9740eadf5bc5b1d4d63c0734e8e5fd1d1776aa2d068d2e4c7173b83803f95f72c0a6759ae1c9b65773c734250d4cfcdf47a19f82aa |
C:\Users\Admin\AppData\Roaming\lib\sqlite-jdbc-3.14.2.1.jar
| MD5 | b33387e15ab150a7bf560abdc73c3bec |
| SHA1 | 66b8075784131f578ef893fd7674273f709b9a4c |
| SHA256 | 2eae3dea1c3dde6104c49f9601074b6038ff6abcf3be23f4b56f6720a4f6a491 |
| SHA512 | 25cfb0d6ce35d0bcb18527d3aa12c63ecb2d9c1b8b78805d1306e516c13480b79bb0d74730aa93bd1752f9ac2da9fdd51781c48844cea2fd52a06c62852c8279 |
C:\Users\Admin\AppData\Roaming\lib\jna-platform-5.5.0.jar
| MD5 | 2f4a99c2758e72ee2b59a73586a2322f |
| SHA1 | af38e7c4d0fc73c23ecd785443705bfdee5b90bf |
| SHA256 | 24d81621f82ac29fcdd9a74116031f5907a2343158e616f4573bbfa2434ae0d5 |
| SHA512 | b860459a0d3bf7ccb600a03aa1d2ac0358619ee89b2b96ed723541e182b6fdab53aefef7992acb4e03fca67aa47cbe3907b1e6060a60b57ed96c4e00c35c7494 |
memory/4812-249-0x0000000001510000-0x0000000001511000-memory.dmp
memory/4812-250-0x0000000001510000-0x0000000001511000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-508929744-1894537824-211734425-1000\83aa4cc77f591dfc2374580bbd95f6ba_3db77c8d-8b44-4cdd-80bd-b67b97edf7a0
| MD5 | c8366ae350e7019aefc9d1e6e6a498c6 |
| SHA1 | 5731d8a3e6568a5f2dfbbc87e3db9637df280b61 |
| SHA256 | 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238 |
| SHA512 | 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd |
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna5005800535938625375.dll
| MD5 | e02979ecd43bcc9061eb2b494ab5af50 |
| SHA1 | 3122ac0e751660f646c73b10c4f79685aa65c545 |
| SHA256 | a66959bec2ef5af730198db9f3b3f7cab0d4ae70ce01bec02bf1d738e6d1ee7a |
| SHA512 | 1e6f7dcb6a557c9b896412a48dd017c16f7a52fa2b9ab513593c9ecd118e86083979821ca7a3e2f098ee349200c823c759cec6599740dd391cb5f354dc29b372 |
memory/4812-267-0x0000000001510000-0x0000000001511000-memory.dmp
memory/4812-268-0x0000000001510000-0x0000000001511000-memory.dmp