Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2023, 20:33

General

  • Target

    Stub-Harma-Crypter10042023.jar

  • Size

    639KB

  • MD5

    a743d1723cec2364537ca8da4a63accb

  • SHA1

    c7f2c306f4d94038aa9f644232e9dabcb6f7095a

  • SHA256

    6e952d44629b791f45274abefa549008414b8a1c3bfcb3f64b904e2a6aec82e8

  • SHA512

    affc04589b4c52f3df00f8463417e86a90906d816006236ef0e0b4d20cfbf8f17822cf466c1be8ad1c55b486586f5868660efea5240ea299f863c782f982f010

  • SSDEEP

    12288:HD5gQ2/qIiZIn4/80AL3gI/dR7+tquNaZTgYt2RgR3Wuk2loStTDss:HDKQ6WZs4kL3gInaHaZ0WnWu5lztTDss

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\Stub-Harma-Crypter10042023.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1696019632395.tmp
      2⤵
      • Views/modifies file attributes
      PID:5104
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1696019632395.tmp" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\system32\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1696019632395.tmp" /f
        3⤵
        • Adds Run key to start application
        PID:4896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1696019632395.tmp

    Filesize

    639KB

    MD5

    a743d1723cec2364537ca8da4a63accb

    SHA1

    c7f2c306f4d94038aa9f644232e9dabcb6f7095a

    SHA256

    6e952d44629b791f45274abefa549008414b8a1c3bfcb3f64b904e2a6aec82e8

    SHA512

    affc04589b4c52f3df00f8463417e86a90906d816006236ef0e0b4d20cfbf8f17822cf466c1be8ad1c55b486586f5868660efea5240ea299f863c782f982f010

  • memory/3064-32-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-34-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-21-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-26-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-27-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-29-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-14-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/3064-31-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-33-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-4-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-35-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-36-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-37-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-40-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB

  • memory/3064-41-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/3064-43-0x0000000002BD0000-0x0000000003BD0000-memory.dmp

    Filesize

    16.0MB