Analysis
-
max time kernel
95s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 14:16
Static task
static1
Behavioral task
behavioral1
Sample
Payment-Advice.jar
Resource
win10v2004-20240220-en
Behavioral task
behavioral2
Sample
Payment-Advice.jar
Resource
win10-20240221-en
General
-
Target
Payment-Advice.jar
-
Size
1.8MB
-
MD5
bcd94e0661cd673bfcb79c368584a881
-
SHA1
0707033eecaa1c1b6add2c1e18731b92165954f1
-
SHA256
8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249
-
SHA512
acf7ec9ee4096f92e6fbd20fea09d077a364b6b16bf16bd1034885e6e25a9af39ce6b03a0b6e822cb11e29a02f48d83416ae7d1bd30188ebad5ab1f5a7c13c89
-
SSDEEP
49152:nw0Cbptl3ED+0iEeqRXbOog7tcnEivsBl5pvthNOZ8jipd9:n9at8+9XqRXbOenEivIlvtuZ8OpP
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 1672 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1672 wrote to memory of 3140 1672 java.exe icacls.exe PID 1672 wrote to memory of 3140 1672 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Payment-Advice.jar1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5fc075ef991568bc2a616a81fd984dea3
SHA137b8f8e3c8ad80c73be44a82a076d47855bd7390
SHA2567b452003c678e2d2e9842ceb11dd8eaedc027184b6b5a88c9a9334c9e0f7082a
SHA512ecc46cbc9d01fa52290591360b30e44954e422a48089908056b090d941c070bde78a49d389837d39d6767dab3a0a69bae066aca8bc58b725ebfc82a1cde5a71a
-
C:\Users\Admin\AppData\Local\Temp\sense_loader\CC00000065D107DB0001852344843412-1828159100_loader_windows_x64.dllFilesize
1.1MB
MD54f0b3278efcdc43470f75edb7fdb84cb
SHA18096149292d77825225bae4368bcc219df9bf98a
SHA256b4183370b1e9c092f4ba706b10109e2e8514969b92fc76875780a2442fd348aa
SHA512c007b4e65afd821a15ebdef95a1bf41ca02023bda1227a4a6373dd58d5b665dc783d1bbe312e95be1824b1817465ee7f0b58c820e64a7da009cf6118a81a48f6
-
memory/1672-66-0x000002A3CDD00000-0x000002A3CDD10000-memory.dmpFilesize
64KB
-
memory/1672-26-0x000002A3E2E00000-0x000002A3E2E22000-memory.dmpFilesize
136KB
-
memory/1672-67-0x000002A3CDD20000-0x000002A3CDD30000-memory.dmpFilesize
64KB
-
memory/1672-69-0x000002A3CDCC0000-0x000002A3CDCD0000-memory.dmpFilesize
64KB
-
memory/1672-37-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-44-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-54-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-60-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-61-0x000002A3CC140000-0x000002A3CC141000-memory.dmpFilesize
4KB
-
memory/1672-62-0x000002A3CC140000-0x000002A3CC141000-memory.dmpFilesize
4KB
-
memory/1672-64-0x000002A3CDC70000-0x000002A3CDC80000-memory.dmpFilesize
64KB
-
memory/1672-65-0x000002A3CDC80000-0x000002A3CDC90000-memory.dmpFilesize
64KB
-
memory/1672-79-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-17-0x000002A3E2E00000-0x000002A3E2E22000-memory.dmpFilesize
136KB
-
memory/1672-27-0x000002A3CC140000-0x000002A3CC141000-memory.dmpFilesize
4KB
-
memory/1672-68-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-70-0x000002A3CDCD0000-0x000002A3CDCE0000-memory.dmpFilesize
64KB
-
memory/1672-71-0x000002A3CDCE0000-0x000002A3CDCF0000-memory.dmpFilesize
64KB
-
memory/1672-72-0x000002A3CDCF0000-0x000002A3CDD00000-memory.dmpFilesize
64KB
-
memory/1672-73-0x000002A3CDD30000-0x000002A3CDD40000-memory.dmpFilesize
64KB
-
memory/1672-74-0x000002A3CDD40000-0x000002A3CDD50000-memory.dmpFilesize
64KB
-
memory/1672-75-0x000002A3CDD50000-0x000002A3CDD60000-memory.dmpFilesize
64KB
-
memory/1672-76-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB
-
memory/1672-77-0x000002A3CDD60000-0x000002A3CDD70000-memory.dmpFilesize
64KB
-
memory/1672-78-0x000002A3CDD70000-0x000002A3CDD80000-memory.dmpFilesize
64KB
-
memory/1672-4-0x000002A3CD9E0000-0x000002A3CE9E0000-memory.dmpFilesize
16.0MB