Analysis
- max time kernel
117s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
01/03/2024, 13:10
Behavioral task
behavioral1
Sample
4.jar
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
4.jar
Resource
win10v2004-20240226-en
3 signatures
150 seconds
General
- Target 4.jar
- Size 479KB
- Sample240301-qel3msgd98
- SHA256 a87af64dfea31dd2e08ae33b9a595b37ed4fa1511f195caa498ee9d51199528c
- MD5 2bc77cbaca6f8ac04a0e4d698cf5133a
- SHA1 34252120652ba3a20588aa557337538d21e5ed88
- SHA512 fc14834e588ac87ea762a181ac12d1a59ca0fc60edb20ac1323493543760b641a6d9951c1bc3e04c66cf3692a284b793eff2cf9d8ab4050fb58d543780c24563
- SSDEEP 12288:K3s/A44AVZhW33fUnE6J5Ur5pxogQNUhIK/0c2qnAf:K30ASVZ0nfs5U1sS7B2qng
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2592 2196 java.exe 29 PID 2196 wrote to memory of 2592 2196 java.exe 29 PID 2196 wrote to memory of 2592 2196 java.exe 29
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\4.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.44105939601241034344751169385849064.class2⤵PID:2592
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_0.44105939601241034344751169385849064.class
- Size 241KB
- SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
- MD5 781fb531354d6f291f1ccab48da6d39f
- SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
- SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
- SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\83aa4cc77f591dfc2374580bbd95f6ba_63be8c66-23f0-4400-84bb-c1a439222555
- Size 45B
- SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
- MD5 c8366ae350e7019aefc9d1e6e6a498c6
- SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
- SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
- MD5 SHA1 SHA512