d6f412b6438459a714ac1ffdb27a69c32b9f1b8718b4d840885d155af2162bc0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/03/2024, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
26934dec6c39f3b5fda01f315a3c36c78556ce61f3bde7dd3f3877d0dde11041.jar
Size 907KB
Sample240304-bhp65sdf7s
SHA256 26934dec6c39f3b5fda01f315a3c36c78556ce61f3bde7dd3f3877d0dde11041
MD5 105f8a6a8ca49ac4e80c44c8d8233d76
SHA1 2318563005c8438232087ff9d8e56901ab15f351
SHA512 88514fc3f1f32ea8ebc7d01a700f6d7a7dc48464f90a6f91bfc570a6832a085b8d8b76c4882885466872ae9061042187c9e0cfe31dc87a733bb743db0ad39450
SSDEEP 24576:i30YDu4J+Qg3avn6a4V6XHfaZhFnKR0ceubno1jR8L:i0cuk+Qgw6PV6XfmfwXeuU6
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3880	icacls.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	javaw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3880	212	java.exe	91
PID 212 wrote to memory of 3880	212	java.exe	91
PID 212 wrote to memory of 3884	212	java.exe	93
PID 212 wrote to memory of 3884	212	java.exe	93
PID 3884 wrote to memory of 4868	3884	wscript.exe	97
PID 3884 wrote to memory of 4868	3884	wscript.exe	97
PID 4868 wrote to memory of 884	4868	javaw.exe	98
PID 4868 wrote to memory of 884	4868	javaw.exe	98

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\26934dec6c39f3b5fda01f315a3c36c78556ce61f3bde7dd3f3877d0dde11041.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3880
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\fvfvdvihbf.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\enxhcmkgoe.txt"
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.759747982961223747654369752713714.class
      4⤵
      Drops file in Program Files directory
      PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 050d5770da3d4e08ca1e92fdeea5bf13fd444d4c9a6f6e22b144765fad868025
MD5 f25f4d8013e4447bb4958af5ca00f794
SHA1 46202da6c11a16575c7cc20659d6ee4c1d9c876c
SHA512 85bc4954804765282d9be3edcef105990368be8adae780d4b160dc5f403da294baf95284fbaa6a361ab061af286fe2d82476249d824bbf9850600c22435f6b78
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 6185000c7bf12a2f172d7d546310327074c569258ca7958ecd453de7a1e45bde
MD5 b93626c8d9a46297418f4f0742a538e5
SHA1 7d4cddefe10970a797eee0d09570c0a812eb024d
SHA512 d26f5af85152d306cc57989d9f3aca881b091bf0d21b8dbaf1821e6fa0cb3efb066f0613ec7e685e12875840bb3134bc49e26d77fcbbc02fa9a77e7bb12729a4
MD5 SHA1 SHA512

Submit Download

_0.759747982961223747654369752713714.class

Path C:\Users\Admin\AppData\Local\Temp\_0.759747982961223747654369752713714.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_8a5f3b39-6e68-4fc5-bbb1-a0dd77d899e9

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-275798769-4264537674-1142822080-1000\83aa4cc77f591dfc2374580bbd95f6ba_8a5f3b39-6e68-4fc5-bbb1-a0dd77d899e9
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

enxhcmkgoe.txt

Path C:\Users\Admin\AppData\Roaming\enxhcmkgoe.txt
Size 473KB
SHA256 ad80dee52ee919b6cd939e9df62a4d48245739390490954163261c3230f105e7
MD5 0602e8885233a881aea5d0737139e453
SHA1 4cbdbec30863978d88e408d7c9087239be32488a
SHA512 1072928c64bdaab970ea47bdf87983ff33ef3f47afebe214579690650cf95acccd4c0240e1dd3ea2f6e8c8578c740fc232e2cbca6b561e2a4b4d29b43feb1dc0
SSDEEP 12288:sBgzjrepgDSRmU5pxogQNUhIK/0c2qnAI:sGbeqsmesS7B2qnn
MD5 SHA1 SHA512 SSDEEP

Submit Download

fvfvdvihbf.js

Path C:\Users\Admin\fvfvdvihbf.js
Size 3.5MB
SHA256 4e23a2ee925d9f6a2a5fa575519f5053f1b079a836420adc387c99e4ef876bf8
MD5 a7bb8d034dc73be8ac961ff7551b344f
SHA1 7e9e1bf4ebd2a66d36a2bdd4ae6e581854ee60fd
SHA512 f3e75dea584563aa0eec6a74419d45cb299b68ef0d85fef46316ab948210ae08b53e30c28e8a81a1510acf003bde99ace68e7646eddaf4489bfbbd12e6b347e5
SSDEEP 6144:DQTJ1BPxv2RfxI0V1ZX/BscEa9DPO97/OYkddbrUuq3w8nfjGz:k8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-4-0x0000021512970000-0x0000021513970000-memory.dmp

Download

memory/212-15-0x0000021511170000-0x0000021511171000-memory.dmp

Download

memory/212-12-0x0000021511170000-0x0000021511171000-memory.dmp

Download

memory/884-91-0x000001B6DA260000-0x000001B6DB260000-memory.dmp

Download

memory/884-89-0x000001B6DA500000-0x000001B6DA510000-memory.dmp

Download

memory/884-40-0x000001B6DA260000-0x000001B6DB260000-memory.dmp

Download

memory/884-49-0x000001B6DA240000-0x000001B6DA241000-memory.dmp

Download

memory/884-84-0x000001B6DA510000-0x000001B6DA520000-memory.dmp

Download

memory/884-90-0x000001B6DA520000-0x000001B6DA530000-memory.dmp

Download

memory/884-87-0x000001B6DA4D0000-0x000001B6DA4E0000-memory.dmp

Download

memory/884-88-0x000001B6DA4F0000-0x000001B6DA500000-memory.dmp

Download

memory/4868-53-0x000002820D3F0000-0x000002820D3F1000-memory.dmp

Download

memory/4868-86-0x000002820D410000-0x000002820E410000-memory.dmp

Download

memory/4868-85-0x000002820D6D0000-0x000002820D6E0000-memory.dmp

Download

memory/4868-81-0x000002820D690000-0x000002820D6A0000-memory.dmp

Download

memory/4868-78-0x000002820D410000-0x000002820E410000-memory.dmp

Download

memory/4868-83-0x000002820D6B0000-0x000002820D6C0000-memory.dmp

Download

memory/4868-60-0x000002820D410000-0x000002820E410000-memory.dmp

Download

memory/4868-39-0x000002820D3F0000-0x000002820D3F1000-memory.dmp

Download

memory/4868-23-0x000002820D410000-0x000002820E410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads