Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/02/2024, 18:41
General
- Target W2-AND-1099-A_PDF.jar
- Size 619KB
- Sample240228-xbzynaba9w
- SHA256 7336bbbddf551fc0bc36d820cb702452750e426608b5caf0cc92707c41499be3
Malware Config
Signatures
- Ratty
Ratty is an open source Java Remote Access Tool.
- Ratty Rat payload 1 IoCs
- Drops startup file 1 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies registry class 2 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\W2-AND-1099-A_PDF.jar1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "W2-AND-1099-A_PDF.jar" /d "C:\Users\Admin\AppData\Roaming\W2-AND-1099-A_PDF.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\W2-AND-1099-A_PDF.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\W2-AND-1099-A_PDF.jar2⤵
- Views/modifies file attributes
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll
imageio2799697056382735159.tmp
W2-AND-1099-A_PDF.jar
memory/1272-69-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-74-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-40-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-42-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-50-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/1272-51-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-54-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-55-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-57-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-56-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/1272-60-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-68-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-4-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-72-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-73-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-36-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-75-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-76-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-81-0x0000000065E40000-0x0000000065E55000-memory.dmp
memory/1272-85-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-87-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-88-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-93-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-95-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-104-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-113-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-18-0x000001C14B8D0000-0x000001C14B8D1000-memory.dmp
memory/1272-122-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-123-0x000001C14D1D0000-0x000001C14E1D0000-memory.dmp
memory/1272-128-0x0000000065E40000-0x0000000065E55000-memory.dmp