Analysis
- max time kernel
259s - max time network
271s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
01/02/2024, 03:56
General
- Target SB COPY6827366180.PDF.jar
- Size 40KB
- Sample240201-ehjadaagb7
- SHA256 243a5315c031347617620bb5c8b694b3308932530519abc04e00c7c4fd7f7c62
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies registry class 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\SB COPY6827366180.PDF.jar"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SB COPY6827366180.PDF.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\SB COPY6827366180.PDF.jar"3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\SB COPY6827366180.PDF.jar"2⤵
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SB COPY6827366180.PDF.jar
3903daac9bc4a3b7.timestamp
memory/3952-35-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/3952-23-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/3952-28-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/3952-12-0x00000185A36D0000-0x00000185A36D1000-memory.dmp
memory/3952-73-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/3952-39-0x00000185A51B0000-0x00000185A51C0000-memory.dmp
memory/3952-41-0x00000185A51C0000-0x00000185A51D0000-memory.dmp
memory/3952-43-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/3952-44-0x00000185A5220000-0x00000185A5230000-memory.dmp
memory/3952-45-0x00000185A5230000-0x00000185A5240000-memory.dmp
memory/3952-46-0x00000185A5200000-0x00000185A5210000-memory.dmp
memory/3952-47-0x00000185A5210000-0x00000185A5220000-memory.dmp
memory/3952-2-0x00000185A4F30000-0x00000185A5F30000-memory.dmp
memory/4224-56-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-66-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-69-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-71-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-72-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-57-0x0000017240530000-0x0000017240531000-memory.dmp
memory/4224-74-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-75-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-76-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-77-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-78-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-80-0x0000017240550000-0x0000017241550000-memory.dmp
memory/4224-81-0x0000017240550000-0x0000017241550000-memory.dmp