63c897ae30cf712b0a3914734b5615f2975de79ce6d3082904aa909295eb909a

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2023, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.GhostRunnersboostrapperjar.jar
Size 639KB
Sample231202-mcq22abh87
SHA256 63c897ae30cf712b0a3914734b5615f2975de79ce6d3082904aa909295eb909a
MD5 a19df41065338e238b44c3204c69bb6a
SHA1 75b18f3ea0b83dca10b7a4746fe69d6f02e22ba8
SHA512 8bba8c383419941e6ba69e85f5bbda98a152c4717b09f75d47b4ce29fb7dbbca8a149de9a724633010270346c9c8c347e33aac9a2c30d421225a5a95324406e7
SSDEEP 12288:pXtCQM/4qInKr4PyoOx3gY/dRf+5kmNyxpgEZ6Rqr3euI2x0S/3DEW:pXMQ4Qn+4aD3gYHqdyxG27eulxH/3DEW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1728	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1701512384768.tmp"	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
772	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 1728	772	java.exe	88
PID 772 wrote to memory of 1728	772	java.exe	88
PID 772 wrote to memory of 4760	772	java.exe	91
PID 772 wrote to memory of 4760	772	java.exe	91
PID 772 wrote to memory of 4116	772	java.exe	93
PID 772 wrote to memory of 4116	772	java.exe	93
PID 4116 wrote to memory of 2344	4116	cmd.exe	95
PID 4116 wrote to memory of 2344	4116	cmd.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4760	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\NEAS.GhostRunnersboostrapperjar.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1728
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1701512384768.tmp
  2⤵
  - Views/modifies file attributes
  PID:4760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1701512384768.tmp" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1701512384768.tmp" /f
    3⤵
    - Adds Run key to start application
    PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 11c60d244f835f320b863b2393395b18c381bce6ece788bc8247c564bbddd3a4
MD5 e89eb8be0baac10071c0b75ec0bf077d
SHA1 36d550023a2118f92908b28d64a951da618b5aed
SHA512 796a643813ca1f9d57e3c218edc83b8b8cbf95a4aed3602fe84ef9f922fb45a7dbafd98a288cfa6d38c5dbe03a180909530f0e53c33d3ac7f81c5d6ae7f3df39
MD5 SHA1 SHA512

Submit Download

1701512384768.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1701512384768.tmp
Size 639KB
SHA256 63c897ae30cf712b0a3914734b5615f2975de79ce6d3082904aa909295eb909a
MD5 a19df41065338e238b44c3204c69bb6a
SHA1 75b18f3ea0b83dca10b7a4746fe69d6f02e22ba8
SHA512 8bba8c383419941e6ba69e85f5bbda98a152c4717b09f75d47b4ce29fb7dbbca8a149de9a724633010270346c9c8c347e33aac9a2c30d421225a5a95324406e7
SSDEEP 12288:pXtCQM/4qInKr4PyoOx3gY/dRf+5kmNyxpgEZ6Rqr3euI2x0S/3DEW:pXMQ4Qn+4aD3gYHqdyxG27eulxH/3DEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/772-37-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-38-0x000001B1D2480000-0x000001B1D2481000-memory.dmp

Download

memory/772-23-0x000001B1D2480000-0x000001B1D2481000-memory.dmp

Download

memory/772-12-0x000001B1D2480000-0x000001B1D2481000-memory.dmp

Download

memory/772-30-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-31-0x000001B1D2480000-0x000001B1D2481000-memory.dmp

Download

memory/772-32-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-34-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-4-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-21-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-40-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-41-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-42-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-43-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-44-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-45-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-48-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

memory/772-50-0x000001B1D24A0000-0x000001B1D34A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads