Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 08:03
Behavioral task
behavioral1
Sample
Prosba-o-oferte.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Prosba-o-oferte.jar
Resource
win10v2004-20240226-en
General
-
Target
Prosba-o-oferte.jar
-
Size
41KB
-
MD5
b225f83a537673f3053e63db84a30662
-
SHA1
55ea9f056d46bdd03a78df3e885565ec845a31c1
-
SHA256
7c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764
-
SHA512
f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523
-
SSDEEP
768:3/AKKv6LboyiFV9jKJ6K71Ifu+Lh+FP+6I3zY103e0NhyDEj:YJvIaV9LqCush+FPKs10ufDE
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prosba-o-oferte.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Prosba-o-oferte = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Prosba-o-oferte.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prosba-o-oferte = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Prosba-o-oferte.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2460 WMIC.exe Token: SeSecurityPrivilege 2460 WMIC.exe Token: SeTakeOwnershipPrivilege 2460 WMIC.exe Token: SeLoadDriverPrivilege 2460 WMIC.exe Token: SeSystemProfilePrivilege 2460 WMIC.exe Token: SeSystemtimePrivilege 2460 WMIC.exe Token: SeProfSingleProcessPrivilege 2460 WMIC.exe Token: SeIncBasePriorityPrivilege 2460 WMIC.exe Token: SeCreatePagefilePrivilege 2460 WMIC.exe Token: SeBackupPrivilege 2460 WMIC.exe Token: SeRestorePrivilege 2460 WMIC.exe Token: SeShutdownPrivilege 2460 WMIC.exe Token: SeDebugPrivilege 2460 WMIC.exe Token: SeSystemEnvironmentPrivilege 2460 WMIC.exe Token: SeRemoteShutdownPrivilege 2460 WMIC.exe Token: SeUndockPrivilege 2460 WMIC.exe Token: SeManageVolumePrivilege 2460 WMIC.exe Token: 33 2460 WMIC.exe Token: 34 2460 WMIC.exe Token: 35 2460 WMIC.exe Token: SeIncreaseQuotaPrivilege 2460 WMIC.exe Token: SeSecurityPrivilege 2460 WMIC.exe Token: SeTakeOwnershipPrivilege 2460 WMIC.exe Token: SeLoadDriverPrivilege 2460 WMIC.exe Token: SeSystemProfilePrivilege 2460 WMIC.exe Token: SeSystemtimePrivilege 2460 WMIC.exe Token: SeProfSingleProcessPrivilege 2460 WMIC.exe Token: SeIncBasePriorityPrivilege 2460 WMIC.exe Token: SeCreatePagefilePrivilege 2460 WMIC.exe Token: SeBackupPrivilege 2460 WMIC.exe Token: SeRestorePrivilege 2460 WMIC.exe Token: SeShutdownPrivilege 2460 WMIC.exe Token: SeDebugPrivilege 2460 WMIC.exe Token: SeSystemEnvironmentPrivilege 2460 WMIC.exe Token: SeRemoteShutdownPrivilege 2460 WMIC.exe Token: SeUndockPrivilege 2460 WMIC.exe Token: SeManageVolumePrivilege 2460 WMIC.exe Token: 33 2460 WMIC.exe Token: 34 2460 WMIC.exe Token: 35 2460 WMIC.exe Token: SeIncreaseQuotaPrivilege 284 WMIC.exe Token: SeSecurityPrivilege 284 WMIC.exe Token: SeTakeOwnershipPrivilege 284 WMIC.exe Token: SeLoadDriverPrivilege 284 WMIC.exe Token: SeSystemProfilePrivilege 284 WMIC.exe Token: SeSystemtimePrivilege 284 WMIC.exe Token: SeProfSingleProcessPrivilege 284 WMIC.exe Token: SeIncBasePriorityPrivilege 284 WMIC.exe Token: SeCreatePagefilePrivilege 284 WMIC.exe Token: SeBackupPrivilege 284 WMIC.exe Token: SeRestorePrivilege 284 WMIC.exe Token: SeShutdownPrivilege 284 WMIC.exe Token: SeDebugPrivilege 284 WMIC.exe Token: SeSystemEnvironmentPrivilege 284 WMIC.exe Token: SeRemoteShutdownPrivilege 284 WMIC.exe Token: SeUndockPrivilege 284 WMIC.exe Token: SeManageVolumePrivilege 284 WMIC.exe Token: 33 284 WMIC.exe Token: 34 284 WMIC.exe Token: 35 284 WMIC.exe Token: SeIncreaseQuotaPrivilege 284 WMIC.exe Token: SeSecurityPrivilege 284 WMIC.exe Token: SeTakeOwnershipPrivilege 284 WMIC.exe Token: SeLoadDriverPrivilege 284 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2276 wrote to memory of 2596 2276 java.exe cmd.exe PID 2276 wrote to memory of 2596 2276 java.exe cmd.exe PID 2276 wrote to memory of 2596 2276 java.exe cmd.exe PID 2276 wrote to memory of 2572 2276 java.exe java.exe PID 2276 wrote to memory of 2572 2276 java.exe java.exe PID 2276 wrote to memory of 2572 2276 java.exe java.exe PID 2596 wrote to memory of 2788 2596 cmd.exe schtasks.exe PID 2596 wrote to memory of 2788 2596 cmd.exe schtasks.exe PID 2596 wrote to memory of 2788 2596 cmd.exe schtasks.exe PID 2572 wrote to memory of 2452 2572 java.exe cmd.exe PID 2572 wrote to memory of 2452 2572 java.exe cmd.exe PID 2572 wrote to memory of 2452 2572 java.exe cmd.exe PID 2452 wrote to memory of 2460 2452 cmd.exe WMIC.exe PID 2452 wrote to memory of 2460 2452 cmd.exe WMIC.exe PID 2452 wrote to memory of 2460 2452 cmd.exe WMIC.exe PID 2572 wrote to memory of 2888 2572 java.exe cmd.exe PID 2572 wrote to memory of 2888 2572 java.exe cmd.exe PID 2572 wrote to memory of 2888 2572 java.exe cmd.exe PID 2888 wrote to memory of 284 2888 cmd.exe WMIC.exe PID 2888 wrote to memory of 284 2888 cmd.exe WMIC.exe PID 2888 wrote to memory of 284 2888 cmd.exe WMIC.exe PID 2572 wrote to memory of 1464 2572 java.exe cmd.exe PID 2572 wrote to memory of 1464 2572 java.exe cmd.exe PID 2572 wrote to memory of 1464 2572 java.exe cmd.exe PID 1464 wrote to memory of 2428 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 2428 1464 cmd.exe WMIC.exe PID 1464 wrote to memory of 2428 1464 cmd.exe WMIC.exe PID 2572 wrote to memory of 2740 2572 java.exe cmd.exe PID 2572 wrote to memory of 2740 2572 java.exe cmd.exe PID 2572 wrote to memory of 2740 2572 java.exe cmd.exe PID 2740 wrote to memory of 2540 2740 cmd.exe WMIC.exe PID 2740 wrote to memory of 2540 2740 cmd.exe WMIC.exe PID 2740 wrote to memory of 2540 2740 cmd.exe WMIC.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Prosba-o-oferte.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Prosba-o-oferte.jarFilesize
41KB
MD5b225f83a537673f3053e63db84a30662
SHA155ea9f056d46bdd03a78df3e885565ec845a31c1
SHA2567c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764
SHA512f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523
-
memory/2276-9-0x00000000025E0000-0x00000000055E0000-memory.dmpFilesize
48.0MB
-
memory/2276-10-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2276-11-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2572-22-0x0000000002610000-0x0000000005610000-memory.dmpFilesize
48.0MB
-
memory/2572-29-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2572-31-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2572-32-0x0000000002610000-0x0000000005610000-memory.dmpFilesize
48.0MB