Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 00:19

General

  • Target

    2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar

  • Size

    761KB

  • MD5

    22e4d501be6ca69e29bc2a21782bd9e1

  • SHA1

    93bd6f32a6afec897679ec96feb72627ea79d6ef

  • SHA256

    1b7560d64e9fc2a468cc3e251669dd05df851f6432b8f3c373f06bd6aaf82d31

  • SHA512

    f4b836bc1aaaece82e2ef590bb214227c23578d57f8e4caf6778f269b85b4337dda99a8f43cb5d286b44528c8d7ac25e6d42a899a98dcdc6047aeb59fdea3c83

  • SSDEEP

    12288:XClCM+jp72GYshJCa65jUXBosjWhMMJWX7AfoJLTpbyjkGZnCgAJt5JEXOG4Ir:XClCRMGhz6JOi4XMwXWoJHUYYnCgAJru

Malware Config

Signatures

  • Ratty

    Ratty is an open source Java Remote Access Tool.

  • Ratty Rat payload 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies registry class 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3668
    • C:\Windows\SYSTEM32\REG.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar" /d "C:\Users\Admin\AppData\Roaming\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:1140
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
      2⤵
      • Views/modifies file attributes
      PID:2804
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
      2⤵
      • Views/modifies file attributes
      PID:5028

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll
    Filesize

    83KB

    MD5

    55f4de7f270663b3dc712b8c9eed422a

    SHA1

    7432773eb4d09dc286d43fcc77ddb0e1e3bce2b4

    SHA256

    47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25

    SHA512

    9da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996

  • C:\Users\Admin\AppData\Roaming\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
    Filesize

    761KB

    MD5

    22e4d501be6ca69e29bc2a21782bd9e1

    SHA1

    93bd6f32a6afec897679ec96feb72627ea79d6ef

    SHA256

    1b7560d64e9fc2a468cc3e251669dd05df851f6432b8f3c373f06bd6aaf82d31

    SHA512

    f4b836bc1aaaece82e2ef590bb214227c23578d57f8e4caf6778f269b85b4337dda99a8f43cb5d286b44528c8d7ac25e6d42a899a98dcdc6047aeb59fdea3c83

  • memory/2976-66-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-39-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-72-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-28-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-75-0x0000000065E40000-0x0000000065E55000-memory.dmp
    Filesize

    84KB

  • memory/2976-45-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-50-0x0000000065E40000-0x0000000065E55000-memory.dmp
    Filesize

    84KB

  • memory/2976-51-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-58-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-59-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-60-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-83-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-2-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-71-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-14-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-18-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-65-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-88-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-91-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-90-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-97-0x000002149BC50000-0x000002149BC51000-memory.dmp
    Filesize

    4KB

  • memory/2976-98-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-100-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-101-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-103-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-109-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-110-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-111-0x000002149BC70000-0x000002149CC70000-memory.dmp
    Filesize

    16.0MB

  • memory/2976-112-0x0000000065E40000-0x0000000065E55000-memory.dmp
    Filesize

    84KB