Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28-06-2023 14:32
Static task
static1
Behavioral task
behavioral1
Sample
PO06028jar.jar
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
PO06028jar.jar
Resource
win10v2004-20230621-en
General
-
Target
PO06028jar.jar
-
Size
70KB
-
MD5
1421b13fcff1ed8b4e8ed6d0ec1ef4ec
-
SHA1
7eb847e16c12dc9159e9f8a0b219926ddf9ec401
-
SHA256
98519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
-
SHA512
c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41
-
SSDEEP
1536:Mf9ewjOD9EgIKgngWmvpkPuH08DdgUFFVk1YSeY9UKihA4X9:CewlKdYPW0AvmYPYTihAo
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PO06028jar.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Windows\CurrentVersion\Run\PO06028jar = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO06028jar.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO06028jar = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\PO06028jar.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid Process Token: SeIncreaseQuotaPrivilege 1380 WMIC.exe Token: SeSecurityPrivilege 1380 WMIC.exe Token: SeTakeOwnershipPrivilege 1380 WMIC.exe Token: SeLoadDriverPrivilege 1380 WMIC.exe Token: SeSystemProfilePrivilege 1380 WMIC.exe Token: SeSystemtimePrivilege 1380 WMIC.exe Token: SeProfSingleProcessPrivilege 1380 WMIC.exe Token: SeIncBasePriorityPrivilege 1380 WMIC.exe Token: SeCreatePagefilePrivilege 1380 WMIC.exe Token: SeBackupPrivilege 1380 WMIC.exe Token: SeRestorePrivilege 1380 WMIC.exe Token: SeShutdownPrivilege 1380 WMIC.exe Token: SeDebugPrivilege 1380 WMIC.exe Token: SeSystemEnvironmentPrivilege 1380 WMIC.exe Token: SeRemoteShutdownPrivilege 1380 WMIC.exe Token: SeUndockPrivilege 1380 WMIC.exe Token: SeManageVolumePrivilege 1380 WMIC.exe Token: 33 1380 WMIC.exe Token: 34 1380 WMIC.exe Token: 35 1380 WMIC.exe Token: SeIncreaseQuotaPrivilege 1380 WMIC.exe Token: SeSecurityPrivilege 1380 WMIC.exe Token: SeTakeOwnershipPrivilege 1380 WMIC.exe Token: SeLoadDriverPrivilege 1380 WMIC.exe Token: SeSystemProfilePrivilege 1380 WMIC.exe Token: SeSystemtimePrivilege 1380 WMIC.exe Token: SeProfSingleProcessPrivilege 1380 WMIC.exe Token: SeIncBasePriorityPrivilege 1380 WMIC.exe Token: SeCreatePagefilePrivilege 1380 WMIC.exe Token: SeBackupPrivilege 1380 WMIC.exe Token: SeRestorePrivilege 1380 WMIC.exe Token: SeShutdownPrivilege 1380 WMIC.exe Token: SeDebugPrivilege 1380 WMIC.exe Token: SeSystemEnvironmentPrivilege 1380 WMIC.exe Token: SeRemoteShutdownPrivilege 1380 WMIC.exe Token: SeUndockPrivilege 1380 WMIC.exe Token: SeManageVolumePrivilege 1380 WMIC.exe Token: 33 1380 WMIC.exe Token: 34 1380 WMIC.exe Token: 35 1380 WMIC.exe Token: SeIncreaseQuotaPrivilege 1548 WMIC.exe Token: SeSecurityPrivilege 1548 WMIC.exe Token: SeTakeOwnershipPrivilege 1548 WMIC.exe Token: SeLoadDriverPrivilege 1548 WMIC.exe Token: SeSystemProfilePrivilege 1548 WMIC.exe Token: SeSystemtimePrivilege 1548 WMIC.exe Token: SeProfSingleProcessPrivilege 1548 WMIC.exe Token: SeIncBasePriorityPrivilege 1548 WMIC.exe Token: SeCreatePagefilePrivilege 1548 WMIC.exe Token: SeBackupPrivilege 1548 WMIC.exe Token: SeRestorePrivilege 1548 WMIC.exe Token: SeShutdownPrivilege 1548 WMIC.exe Token: SeDebugPrivilege 1548 WMIC.exe Token: SeSystemEnvironmentPrivilege 1548 WMIC.exe Token: SeRemoteShutdownPrivilege 1548 WMIC.exe Token: SeUndockPrivilege 1548 WMIC.exe Token: SeManageVolumePrivilege 1548 WMIC.exe Token: 33 1548 WMIC.exe Token: 34 1548 WMIC.exe Token: 35 1548 WMIC.exe Token: SeIncreaseQuotaPrivilege 1548 WMIC.exe Token: SeSecurityPrivilege 1548 WMIC.exe Token: SeTakeOwnershipPrivilege 1548 WMIC.exe Token: SeLoadDriverPrivilege 1548 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid Process procid_target PID 1124 wrote to memory of 1856 1124 java.exe 29 PID 1124 wrote to memory of 1856 1124 java.exe 29 PID 1124 wrote to memory of 1856 1124 java.exe 29 PID 1124 wrote to memory of 976 1124 java.exe 28 PID 1124 wrote to memory of 976 1124 java.exe 28 PID 1124 wrote to memory of 976 1124 java.exe 28 PID 1856 wrote to memory of 1668 1856 cmd.exe 30 PID 1856 wrote to memory of 1668 1856 cmd.exe 30 PID 1856 wrote to memory of 1668 1856 cmd.exe 30 PID 976 wrote to memory of 608 976 java.exe 31 PID 976 wrote to memory of 608 976 java.exe 31 PID 976 wrote to memory of 608 976 java.exe 31 PID 608 wrote to memory of 1380 608 cmd.exe 32 PID 608 wrote to memory of 1380 608 cmd.exe 32 PID 608 wrote to memory of 1380 608 cmd.exe 32 PID 976 wrote to memory of 1688 976 java.exe 34 PID 976 wrote to memory of 1688 976 java.exe 34 PID 976 wrote to memory of 1688 976 java.exe 34 PID 1688 wrote to memory of 1548 1688 cmd.exe 35 PID 1688 wrote to memory of 1548 1688 cmd.exe 35 PID 1688 wrote to memory of 1548 1688 cmd.exe 35 PID 976 wrote to memory of 1860 976 java.exe 36 PID 976 wrote to memory of 1860 976 java.exe 36 PID 976 wrote to memory of 1860 976 java.exe 36 PID 1860 wrote to memory of 1700 1860 cmd.exe 37 PID 1860 wrote to memory of 1700 1860 cmd.exe 37 PID 1860 wrote to memory of 1700 1860 cmd.exe 37 PID 976 wrote to memory of 1988 976 java.exe 38 PID 976 wrote to memory of 1988 976 java.exe 38 PID 976 wrote to memory of 1988 976 java.exe 38 PID 1988 wrote to memory of 924 1988 cmd.exe 39 PID 1988 wrote to memory of 924 1988 cmd.exe 39 PID 1988 wrote to memory of 924 1988 cmd.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\PO06028jar.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\PO06028jar.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵PID:1700
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵PID:924
-
-
-
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO06028jar.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\PO06028jar.jar"3⤵
- Creates scheduled task(s)
PID:1668
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD51421b13fcff1ed8b4e8ed6d0ec1ef4ec
SHA17eb847e16c12dc9159e9f8a0b219926ddf9ec401
SHA25698519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
SHA512c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41
-
Filesize
70KB
MD51421b13fcff1ed8b4e8ed6d0ec1ef4ec
SHA17eb847e16c12dc9159e9f8a0b219926ddf9ec401
SHA25698519a10598b6816b5df829028aab2ccd19ddae46c75f25b25c7bafbe7eb8ce3
SHA512c91c39cb5eea625ba59b60dc0dca227d84da68b36ad4c79e4dfa39f24fb70349b09b24132abbbfccb1a97439a883ed8d7121fcf119f7f7be106c675a37615e41