Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-03-2024 06:42
Behavioral task
behavioral1
Sample
FIYAT-ISTEMI.jar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
FIYAT-ISTEMI.jar
Resource
win10v2004-20240226-en
General
-
Target
FIYAT-ISTEMI.jar
-
Size
64KB
-
MD5
c5ccda6e6a108412c4c34cd17f3b421d
-
SHA1
e9d90ce1bc7881a45cea1a583ce41724f31310d2
-
SHA256
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
-
SHA512
1d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
SSDEEP
1536:grXv/fcVMHH45ofDI4extOPLjOU09xJ9d3W4U0w:gL/xHY5SStOPLjwM4U3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIYAT-ISTEMI.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\FIYAT-ISTEMI = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\FIYAT-ISTEMI.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FIYAT-ISTEMI = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\FIYAT-ISTEMI.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exeWMIC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2708 WMIC.exe Token: SeSecurityPrivilege 2708 WMIC.exe Token: SeTakeOwnershipPrivilege 2708 WMIC.exe Token: SeLoadDriverPrivilege 2708 WMIC.exe Token: SeSystemProfilePrivilege 2708 WMIC.exe Token: SeSystemtimePrivilege 2708 WMIC.exe Token: SeProfSingleProcessPrivilege 2708 WMIC.exe Token: SeIncBasePriorityPrivilege 2708 WMIC.exe Token: SeCreatePagefilePrivilege 2708 WMIC.exe Token: SeBackupPrivilege 2708 WMIC.exe Token: SeRestorePrivilege 2708 WMIC.exe Token: SeShutdownPrivilege 2708 WMIC.exe Token: SeDebugPrivilege 2708 WMIC.exe Token: SeSystemEnvironmentPrivilege 2708 WMIC.exe Token: SeRemoteShutdownPrivilege 2708 WMIC.exe Token: SeUndockPrivilege 2708 WMIC.exe Token: SeManageVolumePrivilege 2708 WMIC.exe Token: 33 2708 WMIC.exe Token: 34 2708 WMIC.exe Token: 35 2708 WMIC.exe Token: SeIncreaseQuotaPrivilege 2708 WMIC.exe Token: SeSecurityPrivilege 2708 WMIC.exe Token: SeTakeOwnershipPrivilege 2708 WMIC.exe Token: SeLoadDriverPrivilege 2708 WMIC.exe Token: SeSystemProfilePrivilege 2708 WMIC.exe Token: SeSystemtimePrivilege 2708 WMIC.exe Token: SeProfSingleProcessPrivilege 2708 WMIC.exe Token: SeIncBasePriorityPrivilege 2708 WMIC.exe Token: SeCreatePagefilePrivilege 2708 WMIC.exe Token: SeBackupPrivilege 2708 WMIC.exe Token: SeRestorePrivilege 2708 WMIC.exe Token: SeShutdownPrivilege 2708 WMIC.exe Token: SeDebugPrivilege 2708 WMIC.exe Token: SeSystemEnvironmentPrivilege 2708 WMIC.exe Token: SeRemoteShutdownPrivilege 2708 WMIC.exe Token: SeUndockPrivilege 2708 WMIC.exe Token: SeManageVolumePrivilege 2708 WMIC.exe Token: 33 2708 WMIC.exe Token: 34 2708 WMIC.exe Token: 35 2708 WMIC.exe Token: SeIncreaseQuotaPrivilege 1672 WMIC.exe Token: SeSecurityPrivilege 1672 WMIC.exe Token: SeTakeOwnershipPrivilege 1672 WMIC.exe Token: SeLoadDriverPrivilege 1672 WMIC.exe Token: SeSystemProfilePrivilege 1672 WMIC.exe Token: SeSystemtimePrivilege 1672 WMIC.exe Token: SeProfSingleProcessPrivilege 1672 WMIC.exe Token: SeIncBasePriorityPrivilege 1672 WMIC.exe Token: SeCreatePagefilePrivilege 1672 WMIC.exe Token: SeBackupPrivilege 1672 WMIC.exe Token: SeRestorePrivilege 1672 WMIC.exe Token: SeShutdownPrivilege 1672 WMIC.exe Token: SeDebugPrivilege 1672 WMIC.exe Token: SeSystemEnvironmentPrivilege 1672 WMIC.exe Token: SeRemoteShutdownPrivilege 1672 WMIC.exe Token: SeUndockPrivilege 1672 WMIC.exe Token: SeManageVolumePrivilege 1672 WMIC.exe Token: 33 1672 WMIC.exe Token: 34 1672 WMIC.exe Token: 35 1672 WMIC.exe Token: SeIncreaseQuotaPrivilege 1672 WMIC.exe Token: SeSecurityPrivilege 1672 WMIC.exe Token: SeTakeOwnershipPrivilege 1672 WMIC.exe Token: SeLoadDriverPrivilege 1672 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
java.execmd.exejava.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2320 wrote to memory of 2600 2320 java.exe cmd.exe PID 2320 wrote to memory of 2600 2320 java.exe cmd.exe PID 2320 wrote to memory of 2600 2320 java.exe cmd.exe PID 2320 wrote to memory of 3060 2320 java.exe java.exe PID 2320 wrote to memory of 3060 2320 java.exe java.exe PID 2320 wrote to memory of 3060 2320 java.exe java.exe PID 2600 wrote to memory of 3024 2600 cmd.exe schtasks.exe PID 2600 wrote to memory of 3024 2600 cmd.exe schtasks.exe PID 2600 wrote to memory of 3024 2600 cmd.exe schtasks.exe PID 3060 wrote to memory of 2556 3060 java.exe cmd.exe PID 3060 wrote to memory of 2556 3060 java.exe cmd.exe PID 3060 wrote to memory of 2556 3060 java.exe cmd.exe PID 2556 wrote to memory of 2708 2556 cmd.exe WMIC.exe PID 2556 wrote to memory of 2708 2556 cmd.exe WMIC.exe PID 2556 wrote to memory of 2708 2556 cmd.exe WMIC.exe PID 3060 wrote to memory of 1768 3060 java.exe cmd.exe PID 3060 wrote to memory of 1768 3060 java.exe cmd.exe PID 3060 wrote to memory of 1768 3060 java.exe cmd.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 1768 wrote to memory of 1672 1768 cmd.exe WMIC.exe PID 3060 wrote to memory of 2692 3060 java.exe cmd.exe PID 3060 wrote to memory of 2692 3060 java.exe cmd.exe PID 3060 wrote to memory of 2692 3060 java.exe cmd.exe PID 2692 wrote to memory of 2728 2692 cmd.exe WMIC.exe PID 2692 wrote to memory of 2728 2692 cmd.exe WMIC.exe PID 2692 wrote to memory of 2728 2692 cmd.exe WMIC.exe PID 3060 wrote to memory of 2744 3060 java.exe cmd.exe PID 3060 wrote to memory of 2744 3060 java.exe cmd.exe PID 3060 wrote to memory of 2744 3060 java.exe cmd.exe PID 2744 wrote to memory of 2752 2744 cmd.exe WMIC.exe PID 2744 wrote to memory of 2752 2744 cmd.exe WMIC.exe PID 2744 wrote to memory of 2752 2744 cmd.exe WMIC.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\FIYAT-ISTEMI.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FIYAT-ISTEMI.jarFilesize
64KB
MD5c5ccda6e6a108412c4c34cd17f3b421d
SHA1e9d90ce1bc7881a45cea1a583ce41724f31310d2
SHA256adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
SHA5121d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
memory/2320-6-0x0000000002510000-0x0000000005510000-memory.dmpFilesize
48.0MB
-
memory/2320-10-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/3060-21-0x0000000002710000-0x0000000005710000-memory.dmpFilesize
48.0MB
-
memory/3060-28-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/3060-31-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/3060-32-0x0000000002710000-0x0000000005710000-memory.dmpFilesize
48.0MB