Analysis
-
max time kernel
121s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2024 02:22
Behavioral task
behavioral1
Sample
361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar
Resource
win10v2004-20240226-en
General
-
Target
361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar
-
Size
64KB
-
MD5
2dc3ec1f2b21887d14f66045a1bf312f
-
SHA1
ee559cc3e69ca0c429d13576e086e2dcba323332
-
SHA256
361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43
-
SHA512
d68443266a0e5ef08fcd72d8bf0cdd3d17914f57c6fbd37e0eaf648b4dff406c4c2e55a3b2daa6dbeddc9ad656971b3dbb0b635caff65d9d28c60ea986682812
-
SSDEEP
1536:S59vZVcVMHH45oJxm4UxtOPLpMy09xHrd3W4UB:SjZnHY5IctOPLpU04UB
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 532 wrote to memory of 4592 532 java.exe icacls.exe PID 532 wrote to memory of 4592 532 java.exe icacls.exe PID 532 wrote to memory of 4696 532 java.exe cmd.exe PID 532 wrote to memory of 4696 532 java.exe cmd.exe PID 532 wrote to memory of 4036 532 java.exe java.exe PID 532 wrote to memory of 4036 532 java.exe java.exe PID 4696 wrote to memory of 64 4696 cmd.exe schtasks.exe PID 4696 wrote to memory of 64 4696 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43.jarFilesize
64KB
MD52dc3ec1f2b21887d14f66045a1bf312f
SHA1ee559cc3e69ca0c429d13576e086e2dcba323332
SHA256361868581afd0fa1eaed8c46990eee5074342033dc26ace69eb0e5eb72876d43
SHA512d68443266a0e5ef08fcd72d8bf0cdd3d17914f57c6fbd37e0eaf648b4dff406c4c2e55a3b2daa6dbeddc9ad656971b3dbb0b635caff65d9d28c60ea986682812
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD580f368e7aa1baa451e803af0f634a01f
SHA10e4271fa36158fa95042612989405143068636fa
SHA256fddadd2ecebf79fa6eb7ee54c70a556e38665c31aba0d73bd5a745403aefca3e
SHA512f2bd8e3eb605306f2a73207d2ffcbceb2619129c9078cfd858ab81050301346b0c452ce4f24308e7b7ae414e73f588f4897ee059e0b633c077473205351643eb
-
memory/532-32-0x000001F000290000-0x000001F0002A0000-memory.dmpFilesize
64KB
-
memory/532-33-0x000001F0002B0000-0x000001F0002C0000-memory.dmpFilesize
64KB
-
memory/532-12-0x000001F07AFC0000-0x000001F07AFC1000-memory.dmpFilesize
4KB
-
memory/532-30-0x000001F07AFC0000-0x000001F07AFC1000-memory.dmpFilesize
4KB
-
memory/532-29-0x000001F000000000-0x000001F001000000-memory.dmpFilesize
16.0MB
-
memory/532-31-0x000001F000280000-0x000001F000290000-memory.dmpFilesize
64KB
-
memory/532-4-0x000001F000000000-0x000001F001000000-memory.dmpFilesize
16.0MB
-
memory/532-18-0x000001F000000000-0x000001F001000000-memory.dmpFilesize
16.0MB
-
memory/532-34-0x000001F0002C0000-0x000001F0002D0000-memory.dmpFilesize
64KB
-
memory/532-35-0x000001F0002D0000-0x000001F0002E0000-memory.dmpFilesize
64KB
-
memory/532-37-0x000001F0002F0000-0x000001F000300000-memory.dmpFilesize
64KB
-
memory/532-39-0x000001F000000000-0x000001F001000000-memory.dmpFilesize
16.0MB
-
memory/532-52-0x000001F000000000-0x000001F001000000-memory.dmpFilesize
16.0MB
-
memory/4036-43-0x000001FB40050000-0x000001FB41050000-memory.dmpFilesize
16.0MB