Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 09:17
Behavioral task
behavioral1
Sample
a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar
Resource
win10v2004-20240226-en
General
-
Target
a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar
-
Size
64KB
-
MD5
b41fe131ce29c70de7b55c400cc1fbcb
-
SHA1
282bd6da4b9047609a04afaab6d7495354baa30f
-
SHA256
a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e
-
SHA512
b90ecf59f78fe23ef72422f8da508448248ced7b86afcc43d1428ae2b120f90d10be10986e7d5ac44488ea12143fea9a48523784533e0c38790a1da22bda8e65
-
SSDEEP
1536:cjgwRZ3jmn6fyKsTHJ7gTtozbVrHyCs3KB:cjVRpVHskyvVrysB
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 3156 wrote to memory of 4012 3156 java.exe icacls.exe PID 3156 wrote to memory of 4012 3156 java.exe icacls.exe PID 3156 wrote to memory of 2468 3156 java.exe cmd.exe PID 3156 wrote to memory of 2468 3156 java.exe cmd.exe PID 2468 wrote to memory of 4420 2468 cmd.exe schtasks.exe PID 2468 wrote to memory of 4420 2468 cmd.exe schtasks.exe PID 3156 wrote to memory of 1156 3156 java.exe java.exe PID 3156 wrote to memory of 1156 3156 java.exe java.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jar"2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3672 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e.jarFilesize
64KB
MD5b41fe131ce29c70de7b55c400cc1fbcb
SHA1282bd6da4b9047609a04afaab6d7495354baa30f
SHA256a96bfbf20a599ee5f39d549564bb417ab4033193fcc3576b6c7151d29a90611e
SHA512b90ecf59f78fe23ef72422f8da508448248ced7b86afcc43d1428ae2b120f90d10be10986e7d5ac44488ea12143fea9a48523784533e0c38790a1da22bda8e65
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5c479600f87996827bf26b9397710537a
SHA1af0d6f95adbd598737a83183aeb24b8de802f2d7
SHA256741b4ea14dcd20a7238ee519df97c36943503356e2a780487777e38957ff8aa9
SHA51214db8c7525a1c8dba785e94724927dbef215cedce729adeafc58684ef1ab45689d9ab1c724b2d4dc5888ff4d45dbeb390d1d2d72879d5000299477cb66a4d4c9
-
memory/1156-43-0x000001E202CC0000-0x000001E203CC0000-memory.dmpFilesize
16.0MB
-
memory/1156-60-0x000001E202CC0000-0x000001E203CC0000-memory.dmpFilesize
16.0MB
-
memory/1156-58-0x000001E202CC0000-0x000001E203CC0000-memory.dmpFilesize
16.0MB
-
memory/1156-57-0x000001E202F50000-0x000001E202F60000-memory.dmpFilesize
64KB
-
memory/1156-56-0x000001E202F40000-0x000001E202F50000-memory.dmpFilesize
64KB
-
memory/1156-50-0x000001E201490000-0x000001E201491000-memory.dmpFilesize
4KB
-
memory/3156-31-0x000001BD80000000-0x000001BD81000000-memory.dmpFilesize
16.0MB
-
memory/3156-37-0x000001BD802B0000-0x000001BD802C0000-memory.dmpFilesize
64KB
-
memory/3156-36-0x000001BD802C0000-0x000001BD802D0000-memory.dmpFilesize
64KB
-
memory/3156-35-0x000001BD80280000-0x000001BD80290000-memory.dmpFilesize
64KB
-
memory/3156-33-0x000001BD80000000-0x000001BD81000000-memory.dmpFilesize
16.0MB
-
memory/3156-2-0x000001BD80000000-0x000001BD81000000-memory.dmpFilesize
16.0MB
-
memory/3156-22-0x000001BD80000000-0x000001BD81000000-memory.dmpFilesize
16.0MB
-
memory/3156-59-0x000001BD80000000-0x000001BD81000000-memory.dmpFilesize
16.0MB
-
memory/3156-11-0x000001BDF1810000-0x000001BDF1811000-memory.dmpFilesize
4KB