a31ec5c2a3c455a99004163f3ec88fc999c4da53f9dd61e0744309ab3d410756

Analysis

max time kernel
159s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
47a81bb95d5df66aaaec60f43a16f5a9.jar
Size 647KB
Sample240107-bpbmbsdag4
SHA256 a31ec5c2a3c455a99004163f3ec88fc999c4da53f9dd61e0744309ab3d410756
MD5 47a81bb95d5df66aaaec60f43a16f5a9
SHA1 fcfd743de4d69531257a90c49d9c39108baf0d19
SHA512 f8d1c2c7586d89914c691dc0dfb86345bbd98507fd941cb2257cd11a2126577857403f142f8c9c45cb9c53c1d315e6bfeca294ff5618e28d039bf9229c0a3be5
SSDEEP 12288:kntjQFFn2Kyc8Y1dvauoLOdaSYUppmw0VCnEQoDdZJcxUOCxBwbsIvgCg0Ah92qi:kMFn2hcp1dvalcdYUppmw0VCnEQkcGV+
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4048	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4048	3996	java.exe	97
PID 3996 wrote to memory of 4048	3996	java.exe	97
PID 3996 wrote to memory of 3452	3996	java.exe	99
PID 3996 wrote to memory of 3452	3996	java.exe	99
PID 3452 wrote to memory of 4024	3452	wscript.exe	100
PID 3452 wrote to memory of 4024	3452	wscript.exe	100
PID 4024 wrote to memory of 3236	4024	javaw.exe	104
PID 4024 wrote to memory of 3236	4024	javaw.exe	104

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\47a81bb95d5df66aaaec60f43a16f5a9.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4048
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\ortflptqle.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\qokwcvzm.txt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.7633716088374698505682129682760323.class
      4⤵
      PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b1a43d5335d60778eedc21038437d17fb2f2db60bc77dfe786104a0a1ca1e784
MD5 c625d5eb6f8f4d4d231afeea25c9615f
SHA1 851bbc01aec010639b94afcd4004fd3a8d38e00a
SHA512 4e7d72562f172c3cb467343b011911c982cb728bc94a0e5faa7b4e587a9dcc679d9a659fb902b8137b1efe0661d0f584fd60a1b0c8c5a18e821a0bc77b1d06b1
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 84a4d1b8b7e5ee77bf7f4b8e607195ef1e3dad11f4bdb2c1c8cd55ee72e8e466
MD5 b85149dbc10176a20b49b65d2e511ae7
SHA1 173e9f184bac814ad8b869f9ca200eabb4f3fd0a
SHA512 b6e58d65c9daa7aef3835cf66374b1c83d5ce2b4b8483ec9af29b6348633ff04c787a69c907ab90fca625ddcd762ebbe98056235a79863b4dd51aa04105db30d
MD5 SHA1 SHA512

Submit Download

_0.7633716088374698505682129682760323.class

Path C:\Users\Admin\AppData\Local\Temp\_0.7633716088374698505682129682760323.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_eefe159c-12f0-419a-b98f-36c89e24da0c

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3073191680-435865314-2862784915-1000\83aa4cc77f591dfc2374580bbd95f6ba_eefe159c-12f0-419a-b98f-36c89e24da0c
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

qokwcvzm.txt

Path C:\Users\Admin\AppData\Roaming\qokwcvzm.txt
Size 479KB
SHA256 e2e441ad0d6f57b43874e342e9c43517890134ad1ff75fe193b73ca44a22cbe1
MD5 682d3c86e29e0c51b8a60e5b48c96dfb
SHA1 459d9471483734f34d6fd4a6242f25503c4dc9f4
SHA512 61a7e16c3b7237af6f87d3f53347f6891d84e92dd7d0adedcba5a851fc7d922091a07708cb4b62cc57fded386dd89e9211bcf0f48783f572be3756a671c612af
SSDEEP 6144:ZWF/YMog5xK7lSyjdtAGdcpy1NFdSI5pxUb7gvY8ulmcCV/hIl0/0c2qna3PJ7pf:E/2IxKp2eFP5pxogQNUhIK/0c2qnAj
MD5 SHA1 SHA512 SSDEEP

Submit Download

ortflptqle.js

Path C:\Users\Admin\ortflptqle.js
Size 1022KB
SHA256 ea446f0b29b00d650d7069b632195fa9a8970f5387b722bd6393256665461274
MD5 38fe11f444fa9732330516e53f3b8822
SHA1 46b9f3e850e9be81964cd604f3b37e1e35ea956f
SHA512 221ec6c47f394d9930045f128eca1ca9c5c66eb5424d4fe461e66ce72ab7b9d2ea1afa1a5b72a62c983d6828fb4a55aaa21fe18e59761d68abd0b7eb912cfdac
SSDEEP 12288:1SsdgExjOs9EWsJlLJOq/nJTHF9NvTR7cSiDvGTckTDrvgpI:UKgoOxzXLQwHF9NvTR7wWZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3236-44-0x00000293B62D0000-0x00000293B72D0000-memory.dmp

Download

memory/3236-109-0x00000293B62D0000-0x00000293B72D0000-memory.dmp

Download

memory/3236-106-0x00000293B62D0000-0x00000293B72D0000-memory.dmp

Download

memory/3236-86-0x00000293B4AD0000-0x00000293B4AD1000-memory.dmp

Download

memory/3236-53-0x00000293B4AD0000-0x00000293B4AD1000-memory.dmp

Download

memory/3996-16-0x000001B9EE2F0000-0x000001B9EE2F1000-memory.dmp

Download

memory/3996-2-0x000001B9EFB30000-0x000001B9F0B30000-memory.dmp

Download

memory/3996-13-0x000001B9EE2F0000-0x000001B9EE2F1000-memory.dmp

Download

memory/3996-12-0x000001B9EFB30000-0x000001B9F0B30000-memory.dmp

Download

memory/3996-11-0x000001B9EE2F0000-0x000001B9EE2F1000-memory.dmp

Download

memory/4024-36-0x0000014CDAF10000-0x0000014CDAF11000-memory.dmp

Download

memory/4024-96-0x0000014CDAF30000-0x0000014CDBF30000-memory.dmp

Download

memory/4024-76-0x0000014CDAF30000-0x0000014CDBF30000-memory.dmp

Download

memory/4024-104-0x0000014CDAF30000-0x0000014CDBF30000-memory.dmp

Download

memory/4024-32-0x0000014CDAF10000-0x0000014CDAF11000-memory.dmp

Download

memory/4024-24-0x0000014CDAF30000-0x0000014CDBF30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads