Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-06-2023 02:01

General

  • Target

    PO-06028.jar

  • Size

    70KB

  • MD5

    1421b13fcff1ed8b4e8ed6d0ec1ef4ec

  • SHA1

    7eb847e16c12dc9159e9f8a0b219926ddf9ec401

  • SHA256

    98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3

  • SHA512

    c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41

  • SSDEEP

    1536:Mf9ewjOD9EgIKgngWmvpkPuH08DdgUFFVk1YSeY9UKihA4X9:CewlKdYPW0AvmYPYTihAo

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\PO-06028.jar
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-06028.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-06028.jar"
        3⤵
        • Creates scheduled task(s)
        PID:3348
    • C:\Program Files\Java\jre1.8.0_66\bin\java.exe
      "C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\PO-06028.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:216
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:812
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1216
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3500
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1204
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
          4⤵
            PID:1652
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4716
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
            4⤵
              PID:2368

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\PO-06028.jar

        Filesize

        70KB

        MD5

        1421b13fcff1ed8b4e8ed6d0ec1ef4ec

        SHA1

        7eb847e16c12dc9159e9f8a0b219926ddf9ec401

        SHA256

        98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3

        SHA512

        c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41

      • C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

        Filesize

        50B

        MD5

        d04a61b14e3281f4f364f825736054b6

        SHA1

        bb37e6a32b56d16b935e7ac0f86e14b1c16dab1a

        SHA256

        8f9670317166a6f6f2465e1e63397a9a237fe0b0e8fd96c3cd37bfb73db612df

        SHA512

        7046c2a48bae79e11e4125c9fc298f609193bc30281d0c27b06ac7f64762a4264a4d2d5d3b487031c17d3fd3cad6df8dc4aa7834842b8115b0ce8eee0aa89fe3

      • C:\Users\Admin\AppData\Roaming\PO-06028.jar

        Filesize

        70KB

        MD5

        1421b13fcff1ed8b4e8ed6d0ec1ef4ec

        SHA1

        7eb847e16c12dc9159e9f8a0b219926ddf9ec401

        SHA256

        98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3

        SHA512

        c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41

      • memory/216-167-0x0000000000530000-0x0000000000531000-memory.dmp

        Filesize

        4KB

      • memory/216-174-0x0000000000530000-0x0000000000531000-memory.dmp

        Filesize

        4KB

      • memory/1016-143-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

        Filesize

        4KB