381ed57571c422224eba562f2052a1ff227ce000a8626b5ed9785383ba8c8ac5

Resubmissions

23/02/2024, 23:31

240223-3h127abf767

23/02/2024, 23:14

240223-273fwabd247

Analysis

max time kernel
93s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
matBast0s.jar
Size 17.2MB
Sample240223-273fwabd24
SHA256 381ed57571c422224eba562f2052a1ff227ce000a8626b5ed9785383ba8c8ac5
MD5 50f5d54a984fbdc7613fb4e922ccbad8
SHA1 44aae7149202c23d97aaf5f42f12f91981e01c86
SHA512 37885ad3d55f02d9aea303ef991fac545c5d6b8e7f11035bd25c6174d3f930b133660bbc65842f487cacd2366480eff70db5429565d4e9a47f4de779a82304f0
SSDEEP 393216:MUrC+jTnATZAA42uR4JvFEAaMt0tKq7tDBBc+UkatbXp8:fAT6mm4JvF8MWtKqhDBBc+Fap8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5068	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
116	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
1292	taskkill.exe
4408	taskkill.exe
5076	taskkill.exe
4080	taskkill.exe
3136	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	4408	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	1292	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5068	java.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 116	5068	java.exe	90
PID 5068 wrote to memory of 116	5068	java.exe	90
PID 5068 wrote to memory of 4408	5068	java.exe	94
PID 5068 wrote to memory of 4408	5068	java.exe	94
PID 5068 wrote to memory of 4080	5068	java.exe	96
PID 5068 wrote to memory of 4080	5068	java.exe	96
PID 5068 wrote to memory of 5076	5068	java.exe	95
PID 5068 wrote to memory of 5076	5068	java.exe	95
PID 5068 wrote to memory of 1292	5068	java.exe	103
PID 5068 wrote to memory of 1292	5068	java.exe	103
PID 5068 wrote to memory of 3136	5068	java.exe	102
PID 5068 wrote to memory of 3136	5068	java.exe	102

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\matBast0s.jar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:116
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im chrome.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msedgewebview2.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msedge.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4080
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im operagx.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im opera.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 29f4ef12560930eca2f6a8ed8f79c11a2d2a3b386628657292688922f6f87abc
MD5 f92877899eb8363bbf65dfd90f22f7ba
SHA1 4742e27197d21db985366b9dfd63c6d643ba1bd3
SHA512 aaa4e7738de5c4e4af124604ac07e88dfeb6e09d58f5740940b80fa62d215545620db2306b198840594cf1a16503b4952220caff0e0743ff12eca8a92ea4de8d
MD5 SHA1 SHA512

Submit Download

LOG-76150tstate2

Path C:\Users\Admin\AppData\Local\Temp\LOG-76150tstate2
Size 8KB
SHA256 3754e3062a9be9f7f5f61670e4cd0a973f7d9b1fa3414b738a2e356c5423a14a
MD5 7e1e4d09f258243636659f356ef6a8f2
SHA1 8a26279dddd5b02a2c87b371c202a34bb442c35c
SHA512 c9ab879aacb217db8aeeebf700cbe191e0e488711e813285acc39e1583a01266055aed6add9db8db8fb5abce6c950011dfce5f989512d2be417fc6cee258b472
SSDEEP 192:soCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCWmN6e2RUJ3Lw0b69gKA2J:c9iIxuERzA83h09RZxYCrUk3LO9FA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG-76150tstate2

Path C:\Users\Admin\AppData\Local\Temp\LOG-76150tstate2
Size 130KB
SHA256 a1d74a0bffbc096a4fc6e8899eea3fd4a6a6486b3131645ac2eba91132584d05
MD5 b53ef03de3f70a87b109dc3b60099ea7
SHA1 c5d7bd5e855869c85e16f71c029ae11641fcd6e8
SHA512 b7c18d58934b4e1d59eeaf58afaf04f2791b1e419f02ae10ec52c555e92233277d69e4c21398861239cde2190189716bb28d4345366872e44447d1491b8cda15
SSDEEP 3072:2J6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5U:2J6d7Yj3Ua9jHThM8fNHK9K5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.41.2.2-0e9d9ba3-7e9e-4735-ad39-3e956faa4a51-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.41.2.2-0e9d9ba3-7e9e-4735-ad39-3e956faa4a51-sqlitejdbc.dll
Size 901KB
SHA256 350509e8f21c2a3b3e63ccadab73e05c15dc6d9e9fd73e7ce516954fad95ef01
MD5 6fc2f9fc4ae08b5571ea05048dc9ba53
SHA1 4abffa2754bb2ca05bd76fcfaf51ce84eeabf6ec
SHA512 747cb9d098de2db45617bad3ae9bc79dff2c62d60f010b23b69a506eec2f55a01bea2e04adb80785ebc61a3a44127e72f3ff495127c84cec3761b723ba4c5d21
SSDEEP 24576:nWXNVebdY3YAzjsMyD9eORwfpMviD82qtr2ssiWV:eCbyIAns5cVxqtr2HiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5068-95-0x0000021620CE0000-0x0000021620CF0000-memory.dmp

Download

memory/5068-98-0x0000021620D90000-0x0000021620DA0000-memory.dmp

Download

memory/5068-18-0x000002161F3E0000-0x000002161F3E1000-memory.dmp

Download

memory/5068-12-0x000002161F3E0000-0x000002161F3E1000-memory.dmp

Download

memory/5068-77-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-88-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-92-0x00007FF854E50000-0x00007FF854F39000-memory.dmp

Download

memory/5068-93-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-4-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-96-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-97-0x0000021620D60000-0x0000021620D70000-memory.dmp

Download

memory/5068-25-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-100-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-99-0x0000021620D10000-0x0000021620D20000-memory.dmp

Download

memory/5068-103-0x0000021620D40000-0x0000021620D50000-memory.dmp

Download

memory/5068-102-0x0000021620D30000-0x0000021620D40000-memory.dmp

Download

memory/5068-101-0x0000021620D20000-0x0000021620D30000-memory.dmp

Download

memory/5068-104-0x0000021620D70000-0x0000021620D80000-memory.dmp

Download

memory/5068-105-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

memory/5068-106-0x0000021620D80000-0x0000021620D90000-memory.dmp

Download

memory/5068-94-0x0000021620CA0000-0x0000021620CB0000-memory.dmp

Download

memory/5068-107-0x0000021620A20000-0x0000021621A20000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads