Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-03-2024 02:36
Behavioral task
behavioral1
Sample
52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar
Resource
win10v2004-20240226-en
General
-
Target
52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar
-
Size
64KB
-
MD5
42e3509850681ccff160078d391581b9
-
SHA1
be3a6011ad989c9328c72cf318f06cbfa499cd82
-
SHA256
52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111
-
SHA512
0628f0a7c9b2b2a73103ef2c6be0d1a40f6c658a6418d324ca0e7fad24a3367de6df01a237516865e03b36bb47bbb0eb2a9cb71a509e6c3dc48ab70d96d9671d
-
SSDEEP
1536:s/LvDzcVMHH4xoLPM4qxtOPLfqA09xtRd3W4Ur:sLD1HYxGWtOPLfos4Ur
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar\"" java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
java.execmd.exedescription pid process target process PID 2164 wrote to memory of 2608 2164 java.exe cmd.exe PID 2164 wrote to memory of 2608 2164 java.exe cmd.exe PID 2164 wrote to memory of 2608 2164 java.exe cmd.exe PID 2164 wrote to memory of 2596 2164 java.exe java.exe PID 2164 wrote to memory of 2596 2164 java.exe java.exe PID 2164 wrote to memory of 2596 2164 java.exe java.exe PID 2608 wrote to memory of 2636 2608 cmd.exe schtasks.exe PID 2608 wrote to memory of 2636 2608 cmd.exe schtasks.exe PID 2608 wrote to memory of 2636 2608 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jarFilesize
64KB
MD542e3509850681ccff160078d391581b9
SHA1be3a6011ad989c9328c72cf318f06cbfa499cd82
SHA25652b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111
SHA5120628f0a7c9b2b2a73103ef2c6be0d1a40f6c658a6418d324ca0e7fad24a3367de6df01a237516865e03b36bb47bbb0eb2a9cb71a509e6c3dc48ab70d96d9671d
-
memory/2164-6-0x0000000002470000-0x0000000005470000-memory.dmpFilesize
48.0MB
-
memory/2164-10-0x0000000001C70000-0x0000000001C71000-memory.dmpFilesize
4KB
-
memory/2596-21-0x0000000002580000-0x0000000005580000-memory.dmpFilesize
48.0MB
-
memory/2596-28-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/2596-29-0x0000000002580000-0x0000000005580000-memory.dmpFilesize
48.0MB