859bd57745e0860248910e01116c2e341299eeb0d62c1652b9748a1304d14f0b

Analysis

max time kernel
236s
max time network
231s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FabricAPI.jar
Size 2.8MB
Sample240222-sr5rmabe9s
SHA256 859bd57745e0860248910e01116c2e341299eeb0d62c1652b9748a1304d14f0b
MD5 627a525660df54e6f36b14d00b91b097
SHA1 7b1e7a915149a8bf494c1339e0b24926de9c9a8d
SHA512 f60f10967387399bf5f7b976037f39d0b9bda01eb26d8418dc0017cc8e8fe5667d19972d7e1364aeb9fe6293ee992682e706ef6e13359964a064a103f90ac7a2
SSDEEP 49152:7R4m2S6KWkmiUWhIsAGIukF6DzJdBobRiGJfu+gdtke/aTyQzUFcGFob:7+m2/hiU6DoMJ2RiGhJgdtQWFxub
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4976	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
456	msedge.exe
456	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
836	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 4976	836	java.exe	85
PID 836 wrote to memory of 4976	836	java.exe	85
PID 456 wrote to memory of 4984	456	msedge.exe	101
PID 456 wrote to memory of 4984	456	msedge.exe	101
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 4660	456	msedge.exe	102
PID 456 wrote to memory of 5048	456	msedge.exe	103
PID 456 wrote to memory of 5048	456	msedge.exe	103
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104
PID 456 wrote to memory of 4788	456	msedge.exe	104

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\FabricAPI.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4976

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbb3a246f8,0x7ffbb3a24708,0x7ffbb3a24718
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,8926961600108923387,4076081584712583934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 8f04959a3170e257e2589b533ba9fee029c6d24224233f7cd80b7111a1adf785
MD5 eaea2b57e5ad3cf5099b905d2c209177
SHA1 7320191665e9509df09af5df49264d051a206035
SHA512 9b5d4beacc47d0d2d436989d98091e50cf178fe23809b2aae5cc79090b8deb605674d97cee9d1e5634114673c13f9853eadaff71a601d1f3682e3d2b4d9e98b8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4
MD5 854f73d7b3f85bf181d2f2002afd17db
SHA1 53e5e04c78d1b81b5e6c400ce226e6be25e0dea8
SHA512 de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76
MD5 a65ab4f620efd5ba6c5e3cba8713e711
SHA1 f79ff4397a980106300bb447ab9cd764af47db08
SHA512 90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56248c1532d135c55abd23715954a78c6429e6cf3adb32ef700463fecd10a082
MD5 84e2d089802ff9fd607c434f7aabe34c
SHA1 51eb79cf10f015631218f335ef4767c90e7d84c9
SHA512 41ade57ce343f643cd321a59c717aa7862493cd344fce1278db3853e5721e1f5cc1f174011f541421262f90f7dacd3206cc49d04ca5991628f42f3a0c6bae730
SSDEEP 96:nwkBSxm/FQYmqZ1y2ywpvWMoiVmdeHlQ13DHjYUWQyV+VD7ziEwb:nwkBPOWY2yGWMXlADHjYrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb4a3e6e7974cb155f67cf35891281b26acd902fc99ced59ac21b791f8fae4a4
MD5 3442635e69785381cf0219f9712b6438
SHA1 31d1971e8322c49d1d9b443b9dbb7499149b43d4
SHA512 8e0ff7a2764857d1b8dc09b722329e1693d9ab4fbc1a62c7627cd9cfd75b08f6b9615f3eac88ef5ea9c38d0f8bf20258f9f6a9743abb329333220853cebc6249
SSDEEP 96:nwkBSxm/FnmqZ1y2ywpvWMoiVmdeHlQ13DHjYUWQyV+VD7AiEwb:nwkBP8WY2yGWMXlADHjYrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 033b86eff2b615ccdf1c2c73ab0fb8925c33f3974a1252904299c38808bb5c73
MD5 19452bc0337dcae571481e88f045fdd8
SHA1 3c2c1266b843f985c412bcc2c3d68246c2663d57
SHA512 8fb03c9b786cbaab71caadea358d9b7ee84031aa6f5966ea9f850b156cae393b6ad137bfb2edda1c75a61d9663fe88ff560bf31d20fb648aa310322f6899ddb1
SSDEEP 384:A9iIxuERzA83h09RZxY6wMktTd9E1MeuBOtZ3y:rIxuERzA83h09RZxrudTOzC
MD5 SHA1 SHA512 SSDEEP