Resubmissions

01/03/2024, 13:10

240301-qel3msgd9810

01/03/2024, 13:06

240301-qb3afsgd7610

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2024, 13:10

General

  • Target
    4.jar
  • Size 479KB
  • Sample240301-qel3msgd98
  • SHA256 a87af64dfea31dd2e08ae33b9a595b37ed4fa1511f195caa498ee9d51199528c
  • MD5 SHA1 SHA512 SSDEEP
Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\4.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Program Files\Java\jre7\bin\java.exe
      "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.44105939601241034344751169385849064.class
      2⤵
        PID:2592

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _0.44105939601241034344751169385849064.class

          • Path C:\Users\Admin\AppData\Local\Temp\_0.44105939601241034344751169385849064.class
          • Size 241KB
          • SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
          • MD5 SHA1 SHA512 SSDEEP

          83aa4cc77f591dfc2374580bbd95f6ba_63be8c66-23f0-4400-84bb-c1a439222555

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2297530677-1229052932-2803917579-1000\83aa4cc77f591dfc2374580bbd95f6ba_63be8c66-23f0-4400-84bb-c1a439222555
          • Size 45B
          • SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
          • MD5 SHA1 SHA512

          memory/2196-5-0x0000000002570000-0x0000000005570000-memory.dmp

          memory/2196-19-0x0000000000140000-0x0000000000141000-memory.dmp

          memory/2196-36-0x0000000002570000-0x0000000005570000-memory.dmp

          memory/2592-20-0x0000000002710000-0x0000000005710000-memory.dmp

          memory/2592-27-0x0000000000340000-0x0000000000341000-memory.dmp

          memory/2592-49-0x0000000002710000-0x0000000005710000-memory.dmp