Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 20:37
Behavioral task
behavioral1
Sample
97294f37f96e37ed20c5f7f9724a2197.jar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97294f37f96e37ed20c5f7f9724a2197.jar
Resource
win10v2004-20231215-en
General
-
Target
97294f37f96e37ed20c5f7f9724a2197.jar
-
Size
332KB
-
MD5
97294f37f96e37ed20c5f7f9724a2197
-
SHA1
73f64f6b2e479915749959b1d931aa0d37daa6ac
-
SHA256
61a85dbaa24eede4c2f39d7630ca79916e6d9354d233b127f96b3428d3d7f161
-
SHA512
542ac7d9a4e0f8cca849d3bc69d5ede30313f31ccd5717a756d21abcb66058519328ee6016d5d66cd18cfcf8dcd37d4f860afa756f6913870b32259511061189
-
SSDEEP
6144:JZjgS007NNMX/+DoklCAFNWClCA+jp02GmaZ/ZJSEPavLFjt+WT:JZNNNzbCClCA+jp02GmWhJnav5jUI
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\97294f37f96e37ed20c5f7f9724a2197.jar family_ratty -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97294f37f96e37ed20c5f7f9724a2197.jar java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 548 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REG.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\97294f37f96e37ed20c5f7f9724a2197.jar = "C:\\Users\\Admin\\AppData\\Roaming\\97294f37f96e37ed20c5f7f9724a2197.jar" REG.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
java.exepid process 548 java.exe 548 java.exe 548 java.exe 548 java.exe 548 java.exe 548 java.exe 548 java.exe 548 java.exe 548 java.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.exedescription pid process target process PID 548 wrote to memory of 1444 548 java.exe icacls.exe PID 548 wrote to memory of 1444 548 java.exe icacls.exe PID 548 wrote to memory of 4452 548 java.exe REG.exe PID 548 wrote to memory of 4452 548 java.exe REG.exe PID 548 wrote to memory of 2096 548 java.exe attrib.exe PID 548 wrote to memory of 2096 548 java.exe attrib.exe PID 548 wrote to memory of 1240 548 java.exe attrib.exe PID 548 wrote to memory of 1240 548 java.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1240 attrib.exe 2096 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\97294f37f96e37ed20c5f7f9724a2197.jar1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "97294f37f96e37ed20c5f7f9724a2197.jar" /d "C:\Users\Admin\AppData\Roaming\97294f37f96e37ed20c5f7f9724a2197.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\97294f37f96e37ed20c5f7f9724a2197.jar2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\97294f37f96e37ed20c5f7f9724a2197.jar2⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD584c049be42c15548c86a18ea4b05b6c2
SHA1fb0388d8e7af67097bbe123ad332ad1fc7e5c0fa
SHA2568230203eff403fd558cd586b6a40eb4bd297dfc319b9e9e30a62d2a398fe03fd
SHA512551cd39b8683dca428aa3dccaa7cdc34b70b43600b6b0c58eae812b864a2cb8b3ce94fa4d241d26762336c20b3baee66c3f1707333308e24222def4f99563836
-
C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dllFilesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
C:\Users\Admin\AppData\Roaming\97294f37f96e37ed20c5f7f9724a2197.jarFilesize
332KB
MD597294f37f96e37ed20c5f7f9724a2197
SHA173f64f6b2e479915749959b1d931aa0d37daa6ac
SHA25661a85dbaa24eede4c2f39d7630ca79916e6d9354d233b127f96b3428d3d7f161
SHA512542ac7d9a4e0f8cca849d3bc69d5ede30313f31ccd5717a756d21abcb66058519328ee6016d5d66cd18cfcf8dcd37d4f860afa756f6913870b32259511061189
-
memory/548-4-0x000001E686E20000-0x000001E687E20000-memory.dmpFilesize
16.0MB
-
memory/548-18-0x000001E685530000-0x000001E685531000-memory.dmpFilesize
4KB
-
memory/548-28-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB
-
memory/548-30-0x000001E686E20000-0x000001E687E20000-memory.dmpFilesize
16.0MB
-
memory/548-33-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB
-
memory/548-39-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB