Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
09/02/2024, 16:49
General
- Target 2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
- Size 761KB
- Sample240209-vbp3caeg63
- SHA256 fb420fbabbd1bb240d07d01b3841943d457b9ccc0f019e4b7b80973d8a282d57
Malware Config
Signatures
- Ratty
Ratty is an open source Java Remote Access Tool.
- Ratty Rat payload 1 IoCs
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar" /d "C:\Users\Admin\AppData\Roaming\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar2⤵
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll
2023-FILES-MY1040-w2-IRS-letter-1099r_PDF.jar
memory/1608-52-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-68-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-12-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-30-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-34-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-36-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-39-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-41-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-46-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-47-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-48-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-49-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-51-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-2-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-20-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-54-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/1608-72-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/1608-64-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-65-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-67-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-56-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-69-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-59-0x00000176D6910000-0x00000176D6911000-memory.dmp
memory/1608-73-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-74-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-75-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-76-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-78-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-79-0x00000176D6930000-0x00000176D7930000-memory.dmp
memory/1608-85-0x0000000065E40000-0x0000000065E55000-memory.dmp