Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 08:00
Behavioral task
behavioral1
Sample
Anfrage-Angebot.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Anfrage-Angebot.jar
Resource
win10v2004-20240226-en
General
-
Target
Anfrage-Angebot.jar
-
Size
64KB
-
MD5
575d75ecae9946950af94951bfac908e
-
SHA1
856900c7d62b852f2f5e854f11d8b072aa3721b1
-
SHA256
374aa16abdd7a527d3500fb1d49f822263fc382706db71e0f58cc3e00045a790
-
SHA512
1fd705f755e348f3d69f1a32315762d23fa74857d8e697f5f2b19081bc1dd210eb70cda20534369ede70ec4a7fe33edb2d67680299b5963af7dae5f2476c259c
-
SSDEEP
1536:4jdiIZTjmn6fVQsJ4J7gTtcMbVrHCCT3Kk/:4jwINVqsJmiVrC/k/
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Anfrage-Angebot.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Anfrage-Angebot = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Anfrage-Angebot.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anfrage-Angebot = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Anfrage-Angebot.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 1456 WMIC.exe Token: SeSecurityPrivilege 1456 WMIC.exe Token: SeTakeOwnershipPrivilege 1456 WMIC.exe Token: SeLoadDriverPrivilege 1456 WMIC.exe Token: SeSystemProfilePrivilege 1456 WMIC.exe Token: SeSystemtimePrivilege 1456 WMIC.exe Token: SeProfSingleProcessPrivilege 1456 WMIC.exe Token: SeIncBasePriorityPrivilege 1456 WMIC.exe Token: SeCreatePagefilePrivilege 1456 WMIC.exe Token: SeBackupPrivilege 1456 WMIC.exe Token: SeRestorePrivilege 1456 WMIC.exe Token: SeShutdownPrivilege 1456 WMIC.exe Token: SeDebugPrivilege 1456 WMIC.exe Token: SeSystemEnvironmentPrivilege 1456 WMIC.exe Token: SeRemoteShutdownPrivilege 1456 WMIC.exe Token: SeUndockPrivilege 1456 WMIC.exe Token: SeManageVolumePrivilege 1456 WMIC.exe Token: 33 1456 WMIC.exe Token: 34 1456 WMIC.exe Token: 35 1456 WMIC.exe Token: SeIncreaseQuotaPrivilege 2264 WMIC.exe Token: SeSecurityPrivilege 2264 WMIC.exe Token: SeTakeOwnershipPrivilege 2264 WMIC.exe Token: SeLoadDriverPrivilege 2264 WMIC.exe Token: SeSystemProfilePrivilege 2264 WMIC.exe Token: SeSystemtimePrivilege 2264 WMIC.exe Token: SeProfSingleProcessPrivilege 2264 WMIC.exe Token: SeIncBasePriorityPrivilege 2264 WMIC.exe Token: SeCreatePagefilePrivilege 2264 WMIC.exe Token: SeBackupPrivilege 2264 WMIC.exe Token: SeRestorePrivilege 2264 WMIC.exe Token: SeShutdownPrivilege 2264 WMIC.exe Token: SeDebugPrivilege 2264 WMIC.exe Token: SeSystemEnvironmentPrivilege 2264 WMIC.exe Token: SeRemoteShutdownPrivilege 2264 WMIC.exe Token: SeUndockPrivilege 2264 WMIC.exe Token: SeManageVolumePrivilege 2264 WMIC.exe Token: 33 2264 WMIC.exe Token: 34 2264 WMIC.exe Token: 35 2264 WMIC.exe Token: SeIncreaseQuotaPrivilege 2264 WMIC.exe Token: SeSecurityPrivilege 2264 WMIC.exe Token: SeTakeOwnershipPrivilege 2264 WMIC.exe Token: SeLoadDriverPrivilege 2264 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2860 wrote to memory of 2516 2860 java.exe cmd.exe PID 2860 wrote to memory of 2516 2860 java.exe cmd.exe PID 2860 wrote to memory of 2516 2860 java.exe cmd.exe PID 2516 wrote to memory of 2476 2516 cmd.exe schtasks.exe PID 2516 wrote to memory of 2476 2516 cmd.exe schtasks.exe PID 2516 wrote to memory of 2476 2516 cmd.exe schtasks.exe PID 2860 wrote to memory of 2504 2860 java.exe java.exe PID 2860 wrote to memory of 2504 2860 java.exe java.exe PID 2860 wrote to memory of 2504 2860 java.exe java.exe PID 2504 wrote to memory of 2784 2504 java.exe cmd.exe PID 2504 wrote to memory of 2784 2504 java.exe cmd.exe PID 2504 wrote to memory of 2784 2504 java.exe cmd.exe PID 2784 wrote to memory of 1456 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 1456 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 1456 2784 cmd.exe WMIC.exe PID 2504 wrote to memory of 2120 2504 java.exe cmd.exe PID 2504 wrote to memory of 2120 2504 java.exe cmd.exe PID 2504 wrote to memory of 2120 2504 java.exe cmd.exe PID 2120 wrote to memory of 2264 2120 cmd.exe WMIC.exe PID 2120 wrote to memory of 2264 2120 cmd.exe WMIC.exe PID 2120 wrote to memory of 2264 2120 cmd.exe WMIC.exe PID 2504 wrote to memory of 2432 2504 java.exe cmd.exe PID 2504 wrote to memory of 2432 2504 java.exe cmd.exe PID 2504 wrote to memory of 2432 2504 java.exe cmd.exe PID 2432 wrote to memory of 2360 2432 cmd.exe WMIC.exe PID 2432 wrote to memory of 2360 2432 cmd.exe WMIC.exe PID 2432 wrote to memory of 2360 2432 cmd.exe WMIC.exe PID 2504 wrote to memory of 2660 2504 java.exe cmd.exe PID 2504 wrote to memory of 2660 2504 java.exe cmd.exe PID 2504 wrote to memory of 2660 2504 java.exe cmd.exe PID 2660 wrote to memory of 2548 2660 cmd.exe WMIC.exe PID 2660 wrote to memory of 2548 2660 cmd.exe WMIC.exe PID 2660 wrote to memory of 2548 2660 cmd.exe WMIC.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Anfrage-Angebot.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Anfrage-Angebot.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Anfrage-Angebot.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Anfrage-Angebot.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Anfrage-Angebot.jarFilesize
64KB
MD5575d75ecae9946950af94951bfac908e
SHA1856900c7d62b852f2f5e854f11d8b072aa3721b1
SHA256374aa16abdd7a527d3500fb1d49f822263fc382706db71e0f58cc3e00045a790
SHA5121fd705f755e348f3d69f1a32315762d23fa74857d8e697f5f2b19081bc1dd210eb70cda20534369ede70ec4a7fe33edb2d67680299b5963af7dae5f2476c259c
-
memory/2504-21-0x0000000002530000-0x0000000005530000-memory.dmpFilesize
48.0MB
-
memory/2504-28-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2504-30-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2504-31-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2504-32-0x0000000002530000-0x0000000005530000-memory.dmpFilesize
48.0MB
-
memory/2860-6-0x0000000002760000-0x0000000005760000-memory.dmpFilesize
48.0MB
-
memory/2860-10-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB