Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 02:31
Behavioral task
behavioral1
Sample
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar
Resource
win10v2004-20240226-en
General
-
Target
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar
-
Size
64KB
-
MD5
1437058c6d28f9a7a3ccdeaceda607bd
-
SHA1
5d7b2f57c74739f8e077dafd25964ef3f990b0ca
-
SHA256
9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
-
SHA512
835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
SSDEEP
1536:fs4vu4cVMHH4/o0oJ4pxtOPLYr/09xIYd3W4Un:fXuMHY/JhtOPLYey4Un
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 5236 wrote to memory of 4624 5236 java.exe icacls.exe PID 5236 wrote to memory of 4624 5236 java.exe icacls.exe PID 5236 wrote to memory of 3120 5236 java.exe cmd.exe PID 5236 wrote to memory of 3120 5236 java.exe cmd.exe PID 5236 wrote to memory of 5184 5236 java.exe java.exe PID 5236 wrote to memory of 5184 5236 java.exe java.exe PID 3120 wrote to memory of 5492 3120 cmd.exe schtasks.exe PID 3120 wrote to memory of 5492 3120 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\9c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b.jarFilesize
64KB
MD51437058c6d28f9a7a3ccdeaceda607bd
SHA15d7b2f57c74739f8e077dafd25964ef3f990b0ca
SHA2569c3abdcc93fb3e179e4ea80afd21df14b6a6f7b23669cef03de2741fb0c0485b
SHA512835b0a988b39f0615d5a7d06a980e26cab4eae567aaa7b5636e076a89e12b132b3def781b891fedfb434844f2348cbe89ae0ead8c014b3f1e02b21628a4d7ef9
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD56b99841116756e63bbe36c5fb76e3629
SHA155b8cd437ddd03c1a3ed04bf2af104f93be01d58
SHA2568ef477e37907770c43356aa62b50084c568a62c72cf3b7a5da984439d0589da7
SHA5127c989a81279421df257f004bdf65b5bda0d77407b97d1cf2fe0629c720c2e65411d12e415a17910a68dba3f839c44c4ce35629cdd9e935de23cb39a2b708d8f2
-
memory/5184-43-0x0000019D80000000-0x0000019D81000000-memory.dmpFilesize
16.0MB
-
memory/5184-53-0x0000019D80000000-0x0000019D81000000-memory.dmpFilesize
16.0MB
-
memory/5184-52-0x0000019D80000000-0x0000019D81000000-memory.dmpFilesize
16.0MB
-
memory/5236-32-0x00000192E7440000-0x00000192E7450000-memory.dmpFilesize
64KB
-
memory/5236-4-0x00000192E71A0000-0x00000192E81A0000-memory.dmpFilesize
16.0MB
-
memory/5236-31-0x00000192E7430000-0x00000192E7440000-memory.dmpFilesize
64KB
-
memory/5236-33-0x00000192E7450000-0x00000192E7460000-memory.dmpFilesize
64KB
-
memory/5236-34-0x00000192E7460000-0x00000192E7470000-memory.dmpFilesize
64KB
-
memory/5236-35-0x00000192E7470000-0x00000192E7480000-memory.dmpFilesize
64KB
-
memory/5236-36-0x00000192E7480000-0x00000192E7490000-memory.dmpFilesize
64KB
-
memory/5236-30-0x00000192E71A0000-0x00000192E81A0000-memory.dmpFilesize
16.0MB
-
memory/5236-18-0x00000192E71A0000-0x00000192E81A0000-memory.dmpFilesize
16.0MB
-
memory/5236-12-0x00000192E58E0000-0x00000192E58E1000-memory.dmpFilesize
4KB