Analysis
-
max time kernel
566s -
max time network
571s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 11:41
Behavioral task
behavioral1
Sample
Prosba-o-oferte.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Prosba-o-oferte.jar
Resource
win10v2004-20240226-en
General
-
Target
Prosba-o-oferte.jar
-
Size
41KB
-
MD5
b225f83a537673f3053e63db84a30662
-
SHA1
55ea9f056d46bdd03a78df3e885565ec845a31c1
-
SHA256
7c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764
-
SHA512
f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523
-
SSDEEP
768:3/AKKv6LboyiFV9jKJ6K71Ifu+Lh+FP+6I3zY103e0NhyDEj:YJvIaV9LqCush+FPKs10ufDE
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prosba-o-oferte.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prosba-o-oferte = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Prosba-o-oferte.jar\"" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Prosba-o-oferte = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Prosba-o-oferte.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
java.execmd.exedescription pid process target process PID 1760 wrote to memory of 2848 1760 java.exe cmd.exe PID 1760 wrote to memory of 2848 1760 java.exe cmd.exe PID 1760 wrote to memory of 2848 1760 java.exe cmd.exe PID 1760 wrote to memory of 2600 1760 java.exe java.exe PID 1760 wrote to memory of 2600 1760 java.exe java.exe PID 1760 wrote to memory of 2600 1760 java.exe java.exe PID 2848 wrote to memory of 2772 2848 cmd.exe schtasks.exe PID 2848 wrote to memory of 2772 2848 cmd.exe schtasks.exe PID 2848 wrote to memory of 2772 2848 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Prosba-o-oferte.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Prosba-o-oferte.jar"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Prosba-o-oferte.jarFilesize
41KB
MD5b225f83a537673f3053e63db84a30662
SHA155ea9f056d46bdd03a78df3e885565ec845a31c1
SHA2567c79a4eed33e40230de0b79cef9fc5425916aea40ae610b234720f609f50b764
SHA512f5453270287724b2b2e576feb9745c35dfb3069029b0d28a69e9415e6b40f55bf7e91cff0f42217c6024d7d0e8e8d20dc47cfa9d08c4182a2406c13378aef523
-
memory/1760-9-0x0000000002170000-0x0000000005170000-memory.dmpFilesize
48.0MB
-
memory/1760-10-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2600-24-0x0000000002130000-0x0000000005130000-memory.dmpFilesize
48.0MB
-
memory/2600-28-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/2600-30-0x0000000002130000-0x0000000005130000-memory.dmpFilesize
48.0MB