381ed57571c422224eba562f2052a1ff227ce000a8626b5ed9785383ba8c8ac5

Resubmissions

23/02/2024, 23:31

240223-3h127abf767

23/02/2024, 23:14

240223-273fwabd247

Analysis

max time kernel
146s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
matBast0s.jar
Size 17.2MB
Sample240223-3h127abf76
SHA256 381ed57571c422224eba562f2052a1ff227ce000a8626b5ed9785383ba8c8ac5
MD5 50f5d54a984fbdc7613fb4e922ccbad8
SHA1 44aae7149202c23d97aaf5f42f12f91981e01c86
SHA512 37885ad3d55f02d9aea303ef991fac545c5d6b8e7f11035bd25c6174d3f930b133660bbc65842f487cacd2366480eff70db5429565d4e9a47f4de779a82304f0
SSDEEP 393216:MUrC+jTnATZAA42uR4JvFEAaMt0tKq7tDBBc+UkatbXp8:fAT6mm4JvF8MWtKqhDBBc+Fap8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
932	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5028	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
3708	taskkill.exe
4504	taskkill.exe
4828	taskkill.exe
3816	taskkill.exe
3204	taskkill.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	3816	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
932	java.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 5028	932	java.exe	88
PID 932 wrote to memory of 5028	932	java.exe	88
PID 932 wrote to memory of 3708	932	java.exe	93
PID 932 wrote to memory of 3708	932	java.exe	93
PID 932 wrote to memory of 4504	932	java.exe	94
PID 932 wrote to memory of 4504	932	java.exe	94
PID 932 wrote to memory of 4828	932	java.exe	96
PID 932 wrote to memory of 4828	932	java.exe	96
PID 932 wrote to memory of 3816	932	java.exe	99
PID 932 wrote to memory of 3816	932	java.exe	99
PID 932 wrote to memory of 3204	932	java.exe	100
PID 932 wrote to memory of 3204	932	java.exe	100

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\matBast0s.jar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:932
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5028
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im chrome.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msedge.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im msedgewebview2.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4828
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im opera.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im operagx.exe /t
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 1871ca390b9ab0d6457062b18e96b97b832d0274df3cc2f1086849b717e76fe1
MD5 6d0a6caf79e52ba86c13582b87f6a186
SHA1 388522eeff0f1295caf8777c8d69bb3367d267c5
SHA512 5718f0ab1fd5c168058d95b6aca3f708b872a2ca4320eb3ed3b6cca67ea624724a46170aee5c1d3fa2ebb6b279cc7f3d711a1f4c187c74b90f2a12cd389c426e
MD5 SHA1 SHA512

Submit Download

LOG-24034tstate2

Path C:\Users\Admin\AppData\Local\Temp\LOG-24034tstate2
Size 8KB
SHA256 71ae63851989a0cf54e31b9dfadc83e72242d365d88be4081d77dd44dc3e6233
MD5 204bc94dfa0382bd7397b93e81ccd989
SHA1 70a098a106264b127b70a6652958795cb962c1c1
SHA512 60e330fb0212991fecd580dd0dece564a677f9473ce8592d64d0ee0d02d6355ea4e4c4fd43f950958a316e85feb438e064d204c1bd6632c5d7e2b1e36cca3d83
SSDEEP 192:8oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxde2RUJXRboqZJ:s9iIxuERzA83h09RZxYx5k2O
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG-24034tstate2

Path C:\Users\Admin\AppData\Local\Temp\LOG-24034tstate2
Size 130KB
SHA256 0eeea28170b7c5c041676a56450edcfab3fb2fa33da84642684ea49c98809d0f
MD5 2ba2bac0fad99a10961c11bbfbd25c32
SHA1 39937652cec44396176a23c02bcd04d5ce58e6bd
SHA512 ec0f86c0b2732677811b73d0e4dc2a46622afdc9f37591dcd518ac541c52a0cfe8ed9c81880010da3f722d47784a814050a4d0efe5dc19885f46ec7555413bca
SSDEEP 3072:LNJ6d7vgj3QHaVRgyKWTHyNiKyc98jbN2/kl4oJLutF/K5O:ZJ6d7Yj3Ua9jHThM8fNHK9K5O
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.41.2.2-6f131bbc-a96d-4f15-bbdc-49697bdac278-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.41.2.2-6f131bbc-a96d-4f15-bbdc-49697bdac278-sqlitejdbc.dll
Size 901KB
SHA256 350509e8f21c2a3b3e63ccadab73e05c15dc6d9e9fd73e7ce516954fad95ef01
MD5 6fc2f9fc4ae08b5571ea05048dc9ba53
SHA1 4abffa2754bb2ca05bd76fcfaf51ce84eeabf6ec
SHA512 747cb9d098de2db45617bad3ae9bc79dff2c62d60f010b23b69a506eec2f55a01bea2e04adb80785ebc61a3a44127e72f3ff495127c84cec3761b723ba4c5d21
SSDEEP 24576:nWXNVebdY3YAzjsMyD9eORwfpMviD82qtr2ssiWV:eCbyIAns5cVxqtr2HiW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/932-87-0x00000176060D0000-0x00000176060E0000-memory.dmp

Download

memory/932-88-0x0000017606140000-0x0000017606150000-memory.dmp

Download

memory/932-16-0x0000017605E30000-0x0000017605E31000-memory.dmp

Download

memory/932-12-0x0000017605E30000-0x0000017605E31000-memory.dmp

Download

memory/932-84-0x0000017605E50000-0x0000017606E50000-memory.dmp

Download

memory/932-86-0x00007FFF8E6C0000-0x00007FFF8E7A9000-memory.dmp

Download

memory/932-4-0x0000017605E50000-0x0000017606E50000-memory.dmp

Download

memory/932-31-0x0000017605E50000-0x0000017606E50000-memory.dmp

Download

memory/932-89-0x00000176060F0000-0x0000017606100000-memory.dmp

Download

memory/932-91-0x0000017606110000-0x0000017606120000-memory.dmp

Download

memory/932-92-0x0000017606120000-0x0000017606130000-memory.dmp

Download

memory/932-90-0x0000017606100000-0x0000017606110000-memory.dmp

Download

memory/932-93-0x0000017606130000-0x0000017606140000-memory.dmp

Download

memory/932-94-0x0000017606160000-0x0000017606170000-memory.dmp

Download

memory/932-95-0x0000017605E50000-0x0000017606E50000-memory.dmp

Download

memory/932-96-0x0000017605E50000-0x0000017606E50000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads