Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 07:07
Behavioral task
behavioral1
Sample
Isteme-Formu.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Isteme-Formu.jar
Resource
win10v2004-20240226-en
General
-
Target
Isteme-Formu.jar
-
Size
64KB
-
MD5
1437058c6d28f9a7a3ccdeaceda607bd
-
SHA1
5d7b2f57c74739f8e077dafd25964ef3f990b0ca
-
SHA256
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
-
SHA512
835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
SSDEEP
1536:fs4vu4cVMHH4/o0oJ4pxtOPLYr/09xIYd3W4Un:fXuMHY/JhtOPLYey4Un
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Isteme-Formu.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Isteme-Formu = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Isteme-Formu.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isteme-Formu = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Isteme-Formu.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 2512 WMIC.exe Token: SeSecurityPrivilege 2512 WMIC.exe Token: SeTakeOwnershipPrivilege 2512 WMIC.exe Token: SeLoadDriverPrivilege 2512 WMIC.exe Token: SeSystemProfilePrivilege 2512 WMIC.exe Token: SeSystemtimePrivilege 2512 WMIC.exe Token: SeProfSingleProcessPrivilege 2512 WMIC.exe Token: SeIncBasePriorityPrivilege 2512 WMIC.exe Token: SeCreatePagefilePrivilege 2512 WMIC.exe Token: SeBackupPrivilege 2512 WMIC.exe Token: SeRestorePrivilege 2512 WMIC.exe Token: SeShutdownPrivilege 2512 WMIC.exe Token: SeDebugPrivilege 2512 WMIC.exe Token: SeSystemEnvironmentPrivilege 2512 WMIC.exe Token: SeRemoteShutdownPrivilege 2512 WMIC.exe Token: SeUndockPrivilege 2512 WMIC.exe Token: SeManageVolumePrivilege 2512 WMIC.exe Token: 33 2512 WMIC.exe Token: 34 2512 WMIC.exe Token: 35 2512 WMIC.exe Token: SeIncreaseQuotaPrivilege 1936 WMIC.exe Token: SeSecurityPrivilege 1936 WMIC.exe Token: SeTakeOwnershipPrivilege 1936 WMIC.exe Token: SeLoadDriverPrivilege 1936 WMIC.exe Token: SeSystemProfilePrivilege 1936 WMIC.exe Token: SeSystemtimePrivilege 1936 WMIC.exe Token: SeProfSingleProcessPrivilege 1936 WMIC.exe Token: SeIncBasePriorityPrivilege 1936 WMIC.exe Token: SeCreatePagefilePrivilege 1936 WMIC.exe Token: SeBackupPrivilege 1936 WMIC.exe Token: SeRestorePrivilege 1936 WMIC.exe Token: SeShutdownPrivilege 1936 WMIC.exe Token: SeDebugPrivilege 1936 WMIC.exe Token: SeSystemEnvironmentPrivilege 1936 WMIC.exe Token: SeRemoteShutdownPrivilege 1936 WMIC.exe Token: SeUndockPrivilege 1936 WMIC.exe Token: SeManageVolumePrivilege 1936 WMIC.exe Token: 33 1936 WMIC.exe Token: 34 1936 WMIC.exe Token: 35 1936 WMIC.exe Token: SeIncreaseQuotaPrivilege 1936 WMIC.exe Token: SeSecurityPrivilege 1936 WMIC.exe Token: SeTakeOwnershipPrivilege 1936 WMIC.exe Token: SeLoadDriverPrivilege 1936 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2320 wrote to memory of 2612 2320 java.exe cmd.exe PID 2320 wrote to memory of 2612 2320 java.exe cmd.exe PID 2320 wrote to memory of 2612 2320 java.exe cmd.exe PID 2320 wrote to memory of 2588 2320 java.exe java.exe PID 2320 wrote to memory of 2588 2320 java.exe java.exe PID 2320 wrote to memory of 2588 2320 java.exe java.exe PID 2612 wrote to memory of 2712 2612 cmd.exe schtasks.exe PID 2612 wrote to memory of 2712 2612 cmd.exe schtasks.exe PID 2612 wrote to memory of 2712 2612 cmd.exe schtasks.exe PID 2588 wrote to memory of 2480 2588 java.exe cmd.exe PID 2588 wrote to memory of 2480 2588 java.exe cmd.exe PID 2588 wrote to memory of 2480 2588 java.exe cmd.exe PID 2480 wrote to memory of 2512 2480 cmd.exe WMIC.exe PID 2480 wrote to memory of 2512 2480 cmd.exe WMIC.exe PID 2480 wrote to memory of 2512 2480 cmd.exe WMIC.exe PID 2588 wrote to memory of 1548 2588 java.exe cmd.exe PID 2588 wrote to memory of 1548 2588 java.exe cmd.exe PID 2588 wrote to memory of 1548 2588 java.exe cmd.exe PID 1548 wrote to memory of 1936 1548 cmd.exe WMIC.exe PID 1548 wrote to memory of 1936 1548 cmd.exe WMIC.exe PID 1548 wrote to memory of 1936 1548 cmd.exe WMIC.exe PID 2588 wrote to memory of 2864 2588 java.exe cmd.exe PID 2588 wrote to memory of 2864 2588 java.exe cmd.exe PID 2588 wrote to memory of 2864 2588 java.exe cmd.exe PID 2864 wrote to memory of 2872 2864 cmd.exe WMIC.exe PID 2864 wrote to memory of 2872 2864 cmd.exe WMIC.exe PID 2864 wrote to memory of 2872 2864 cmd.exe WMIC.exe PID 2588 wrote to memory of 2860 2588 java.exe cmd.exe PID 2588 wrote to memory of 2860 2588 java.exe cmd.exe PID 2588 wrote to memory of 2860 2588 java.exe cmd.exe PID 2860 wrote to memory of 2876 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 2876 2860 cmd.exe WMIC.exe PID 2860 wrote to memory of 2876 2860 cmd.exe WMIC.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Isteme-Formu.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Isteme-Formu.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Isteme-Formu.jarFilesize
64KB
MD51437058c6d28f9a7a3ccdeaceda607bd
SHA15d7b2f57c74739f8e077dafd25964ef3f990b0ca
SHA2569c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
SHA512835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
memory/2320-3-0x00000000026F0000-0x00000000056F0000-memory.dmpFilesize
48.0MB
-
memory/2320-10-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2588-21-0x0000000002680000-0x0000000005680000-memory.dmpFilesize
48.0MB
-
memory/2588-28-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/2588-31-0x0000000002680000-0x0000000005680000-memory.dmpFilesize
48.0MB