669a95f4fb366c02950b52b86f5d906dc150bca3fa710453a49eddef3471a333

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Attachment.jar
Size 622KB
Sample240228-m2ltlsaa2y
SHA256 669a95f4fb366c02950b52b86f5d906dc150bca3fa710453a49eddef3471a333
MD5 efd645a5c1c5a8ebfee8f1cb2a139920
SHA1 58e80fdbabec6c26ba09d7c34ee075b0be6017c2
SHA512 c886dd8b5a8de9ea791c62e3caaf439387f051214b58085e5037e3eec59a17ee0225f31c12c0737a1b721c98d314dcbfc935ef683e89391f1cbc3d4770d9e709
SSDEEP 12288:y2/TdQOo5CKAGqMJIBKGUuR8PALJj28/VSVjMkbdMY02C+HLzqE:yo5MJ/GhRrLJj28NSVjjbA2hf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2672	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2668	javaw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2672	3504	java.exe	89
PID 3504 wrote to memory of 2672	3504	java.exe	89
PID 3504 wrote to memory of 4244	3504	java.exe	92
PID 3504 wrote to memory of 4244	3504	java.exe	92
PID 4244 wrote to memory of 2668	4244	wscript.exe	94
PID 4244 wrote to memory of 2668	4244	wscript.exe	94
PID 2668 wrote to memory of 368	2668	javaw.exe	95
PID 2668 wrote to memory of 368	2668	javaw.exe	95

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Attachment.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2672
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\ekmvqyemaq.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\fogkbwlvoa.txt"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.347517944601870138166247043904698518.class
      4⤵
      Drops file in Program Files directory
      PID:368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 9943825936c19fed22290e88a26690dc7b295dc1d85864e13a9b22913b5cf355
MD5 312744ed9c30d646253a3d49aff52fb8
SHA1 2e6aa01140408e3e0a893dcdde802b0fedaa4c44
SHA512 0edaa8b48851b7e7fe08b44df2145f60bb68d5c361953f25c96b1d22b59051eeca9066ed82b1b490425dbaa463ea8abca3240376afbb8c19b467faf21f4e4491
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e29793c196b9d0113b91ef88663d3a81ba3241806a2a5920470b66a82fd1f5f7
MD5 bdc36a863c9d2a136351ce54539a74d6
SHA1 98a251daeef58dccac6953ccb1840f078c74c8e1
SHA512 c3563c7533e33a2dcb5dc121fa10dbdee00855d892d8a5ad3cbae3978c2057cbf5b8000c4229200e5c5f1b6ca35815701ab05b180ca79bf37bd6d4ae674b4847
MD5 SHA1 SHA512

Submit Download

_0.347517944601870138166247043904698518.class

Path C:\Users\Admin\AppData\Local\Temp\_0.347517944601870138166247043904698518.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_fd53e311-4742-43c9-a8e2-ced45f79c52d

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2727153400-192325109-1870347593-1000\83aa4cc77f591dfc2374580bbd95f6ba_fd53e311-4742-43c9-a8e2-ced45f79c52d
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

fogkbwlvoa.txt

Path C:\Users\Admin\AppData\Roaming\fogkbwlvoa.txt
Size 473KB
SHA256 01c654ad8189e58c33075ca7b995720f1f5b2c8d49b0ce2ac82d323ff40340b1
MD5 219a01e09cd1edb7141255ab597b3b5a
SHA1 d4bb90ac587bbe9e1f9d4e73823575d94d6785a5
SHA512 290d72bcfec99ce958d66830ca08a1a41eec0a378249fa421ecd2dc7af073ae85dd7554816f6152b58f6854dcba8f92875bf51d346a0906fdd1b742773c4cb89
SSDEEP 12288:6aqJaRez1ORhk5IAP37pA06bgVWfFVK5pxogQNUhIK/0c2qnA+:kE8APYP3u06UVM7osS7B2qnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ekmvqyemaq.js

Path C:\Users\Admin\ekmvqyemaq.js
Size 941KB
SHA256 105b9aa94fc7e20214f0423342d860452bf912b51b3b6ed43804affe0c8e23b7
MD5 da53c75c1c309bb790049f22ca7e6115
SHA1 49695a4b21037c34843b6b3c8dea763bac57450a
SHA512 4ce6a408490127773f46b89633b474d612065063511f8f07b411ede5ba8b40e19518033e083fc919b708a24c4224581fe37db4e17dcc5fb862a2f7b98c2a82e8
SSDEEP 12288:k7cWG+y2x8Ud9W0D2WRXbG4L3yhUxXiDCaOYdiMd5Jnwz4ZNM+em:k7cpWx/d9W0D28XpU6+XO8XZum
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-90-0x00000255002A0000-0x00000255002B0000-memory.dmp

Download

memory/368-91-0x00000255002B0000-0x00000255002C0000-memory.dmp

Download

memory/368-39-0x0000025500000000-0x0000025501000000-memory.dmp

Download

memory/368-89-0x0000025500290000-0x00000255002A0000-memory.dmp

Download

memory/368-47-0x00000255787B0000-0x00000255787B1000-memory.dmp

Download

memory/368-87-0x0000025500270000-0x0000025500280000-memory.dmp

Download

memory/368-88-0x0000025500280000-0x0000025500290000-memory.dmp

Download

memory/368-60-0x00000255787B0000-0x00000255787B1000-memory.dmp

Download

memory/368-86-0x00000255002C0000-0x00000255002D0000-memory.dmp

Download

memory/2668-96-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-101-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-110-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/2668-61-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/2668-57-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-28-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/2668-92-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/2668-36-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-84-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-83-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/2668-97-0x00000280B44A0000-0x00000280B44A1000-memory.dmp

Download

memory/2668-102-0x00000280B44C0000-0x00000280B54C0000-memory.dmp

Download

memory/3504-4-0x000002B95C820000-0x000002B95D820000-memory.dmp

Download

memory/3504-14-0x000002B95C800000-0x000002B95C801000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads