Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2023 02:01
Static task
static1
Behavioral task
behavioral1
Sample
PO-06028.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
PO-06028.jar
Resource
win10v2004-20230621-en
General
-
Target
PO-06028.jar
-
Size
70KB
-
MD5
1421b13fcff1ed8b4e8ed6d0ec1ef4ec
-
SHA1
7eb847e16c12dc9159e9f8a0b219926ddf9ec401
-
SHA256
98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
-
SHA512
c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41
-
SSDEEP
1536:Mf9ewjOD9EgIKgngWmvpkPuH08DdgUFFVk1YSeY9UKihA4X9:CewlKdYPW0AvmYPYTihAo
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO-06028.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO-06028 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO-06028.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO-06028 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO-06028.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid Process Token: SeIncreaseQuotaPrivilege 1216 WMIC.exe Token: SeSecurityPrivilege 1216 WMIC.exe Token: SeTakeOwnershipPrivilege 1216 WMIC.exe Token: SeLoadDriverPrivilege 1216 WMIC.exe Token: SeSystemProfilePrivilege 1216 WMIC.exe Token: SeSystemtimePrivilege 1216 WMIC.exe Token: SeProfSingleProcessPrivilege 1216 WMIC.exe Token: SeIncBasePriorityPrivilege 1216 WMIC.exe Token: SeCreatePagefilePrivilege 1216 WMIC.exe Token: SeBackupPrivilege 1216 WMIC.exe Token: SeRestorePrivilege 1216 WMIC.exe Token: SeShutdownPrivilege 1216 WMIC.exe Token: SeDebugPrivilege 1216 WMIC.exe Token: SeSystemEnvironmentPrivilege 1216 WMIC.exe Token: SeRemoteShutdownPrivilege 1216 WMIC.exe Token: SeUndockPrivilege 1216 WMIC.exe Token: SeManageVolumePrivilege 1216 WMIC.exe Token: 33 1216 WMIC.exe Token: 34 1216 WMIC.exe Token: 35 1216 WMIC.exe Token: 36 1216 WMIC.exe Token: SeIncreaseQuotaPrivilege 1216 WMIC.exe Token: SeSecurityPrivilege 1216 WMIC.exe Token: SeTakeOwnershipPrivilege 1216 WMIC.exe Token: SeLoadDriverPrivilege 1216 WMIC.exe Token: SeSystemProfilePrivilege 1216 WMIC.exe Token: SeSystemtimePrivilege 1216 WMIC.exe Token: SeProfSingleProcessPrivilege 1216 WMIC.exe Token: SeIncBasePriorityPrivilege 1216 WMIC.exe Token: SeCreatePagefilePrivilege 1216 WMIC.exe Token: SeBackupPrivilege 1216 WMIC.exe Token: SeRestorePrivilege 1216 WMIC.exe Token: SeShutdownPrivilege 1216 WMIC.exe Token: SeDebugPrivilege 1216 WMIC.exe Token: SeSystemEnvironmentPrivilege 1216 WMIC.exe Token: SeRemoteShutdownPrivilege 1216 WMIC.exe Token: SeUndockPrivilege 1216 WMIC.exe Token: SeManageVolumePrivilege 1216 WMIC.exe Token: 33 1216 WMIC.exe Token: 34 1216 WMIC.exe Token: 35 1216 WMIC.exe Token: 36 1216 WMIC.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe Token: SeSecurityPrivilege 1204 WMIC.exe Token: SeTakeOwnershipPrivilege 1204 WMIC.exe Token: SeLoadDriverPrivilege 1204 WMIC.exe Token: SeSystemProfilePrivilege 1204 WMIC.exe Token: SeSystemtimePrivilege 1204 WMIC.exe Token: SeProfSingleProcessPrivilege 1204 WMIC.exe Token: SeIncBasePriorityPrivilege 1204 WMIC.exe Token: SeCreatePagefilePrivilege 1204 WMIC.exe Token: SeBackupPrivilege 1204 WMIC.exe Token: SeRestorePrivilege 1204 WMIC.exe Token: SeShutdownPrivilege 1204 WMIC.exe Token: SeDebugPrivilege 1204 WMIC.exe Token: SeSystemEnvironmentPrivilege 1204 WMIC.exe Token: SeRemoteShutdownPrivilege 1204 WMIC.exe Token: SeUndockPrivilege 1204 WMIC.exe Token: SeManageVolumePrivilege 1204 WMIC.exe Token: 33 1204 WMIC.exe Token: 34 1204 WMIC.exe Token: 35 1204 WMIC.exe Token: 36 1204 WMIC.exe Token: SeIncreaseQuotaPrivilege 1204 WMIC.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1016 wrote to memory of 1528 1016 java.exe 85 PID 1016 wrote to memory of 1528 1016 java.exe 85 PID 1016 wrote to memory of 216 1016 java.exe 87 PID 1016 wrote to memory of 216 1016 java.exe 87 PID 1528 wrote to memory of 3348 1528 cmd.exe 89 PID 1528 wrote to memory of 3348 1528 cmd.exe 89 PID 216 wrote to memory of 812 216 java.exe 91 PID 216 wrote to memory of 812 216 java.exe 91 PID 812 wrote to memory of 1216 812 cmd.exe 93 PID 812 wrote to memory of 1216 812 cmd.exe 93 PID 216 wrote to memory of 3500 216 java.exe 94 PID 216 wrote to memory of 3500 216 java.exe 94 PID 3500 wrote to memory of 1204 3500 cmd.exe 96 PID 3500 wrote to memory of 1204 3500 cmd.exe 96 PID 216 wrote to memory of 4008 216 java.exe 97 PID 216 wrote to memory of 4008 216 java.exe 97 PID 4008 wrote to memory of 1652 4008 cmd.exe 99 PID 4008 wrote to memory of 1652 4008 cmd.exe 99 PID 216 wrote to memory of 4716 216 java.exe 100 PID 216 wrote to memory of 4716 216 java.exe 100 PID 4716 wrote to memory of 2368 4716 cmd.exe 102 PID 4716 wrote to memory of 2368 4716 cmd.exe 102 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\ProgramData\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\PO-06028.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-06028.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO-06028.jar"3⤵
- Creates scheduled task(s)
PID:3348
-
-
-
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\PO-06028.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵PID:1652
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list4⤵PID:2368
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD51421b13fcff1ed8b4e8ed6d0ec1ef4ec
SHA17eb847e16c12dc9159e9f8a0b219926ddf9ec401
SHA25698519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
SHA512c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41
-
Filesize
50B
MD5d04a61b14e3281f4f364f825736054b6
SHA1bb37e6a32b56d16b935e7ac0f86e14b1c16dab1a
SHA2568f9670317166a6f6f2465e1e63397a9a237fe0b0e8fd96c3cd37bfb73db612df
SHA5127046c2a48bae79e11e4125c9fc298f609193bc30281d0c27b06ac7f64762a4264a4d2d5d3b487031c17d3fd3cad6df8dc4aa7834842b8115b0ce8eee0aa89fe3
-
Filesize
70KB
MD51421b13fcff1ed8b4e8ed6d0ec1ef4ec
SHA17eb847e16c12dc9159e9f8a0b219926ddf9ec401
SHA25698519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
SHA512c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41