Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2024 06:42
Behavioral task
behavioral1
Sample
FIYAT-ISTEMI.jar
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
FIYAT-ISTEMI.jar
Resource
win10v2004-20240226-en
General
-
Target
FIYAT-ISTEMI.jar
-
Size
64KB
-
MD5
c5ccda6e6a108412c4c34cd17f3b421d
-
SHA1
e9d90ce1bc7881a45cea1a583ce41724f31310d2
-
SHA256
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
-
SHA512
1d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
SSDEEP
1536:grXv/fcVMHH45ofDI4extOPLjOU09xJ9d3W4U0w:gL/xHY5SStOPLjwM4U3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIYAT-ISTEMI.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FIYAT-ISTEMI = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\FIYAT-ISTEMI.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FIYAT-ISTEMI = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\FIYAT-ISTEMI.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 1612 wrote to memory of 3712 1612 java.exe icacls.exe PID 1612 wrote to memory of 3712 1612 java.exe icacls.exe PID 1612 wrote to memory of 3676 1612 java.exe cmd.exe PID 1612 wrote to memory of 3676 1612 java.exe cmd.exe PID 1612 wrote to memory of 3912 1612 java.exe java.exe PID 1612 wrote to memory of 3912 1612 java.exe java.exe PID 3676 wrote to memory of 4176 3676 cmd.exe schtasks.exe PID 3676 wrote to memory of 4176 3676 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\FIYAT-ISTEMI.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\FIYAT-ISTEMI.jar"2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\FIYAT-ISTEMI.jarFilesize
64KB
MD5c5ccda6e6a108412c4c34cd17f3b421d
SHA1e9d90ce1bc7881a45cea1a583ce41724f31310d2
SHA256adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
SHA5121d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5cd74e5631953435973877c95e264e1f6
SHA100322efa5aeae0c36c3cea4eee6906d0d59b5b74
SHA256f53a7ff37824b4a04ffe1728eff8a5f972a756274f5f2061db72916d049ad5ff
SHA512ec15d1afd67d1aeb5d34303fa76b20edc697701d77c11f31fc8e252018c019990a60c8b825f3385ae498b41e6c0d9e0720b84039b0b8a54d53497525c1e75347
-
memory/1612-38-0x00000191274E0000-0x00000191274F0000-memory.dmpFilesize
64KB
-
memory/1612-41-0x0000019127220000-0x0000019128220000-memory.dmpFilesize
16.0MB
-
memory/1612-23-0x0000019127220000-0x0000019128220000-memory.dmpFilesize
16.0MB
-
memory/1612-12-0x00000191259B0000-0x00000191259B1000-memory.dmpFilesize
4KB
-
memory/1612-32-0x0000019127220000-0x0000019128220000-memory.dmpFilesize
16.0MB
-
memory/1612-34-0x00000191274A0000-0x00000191274B0000-memory.dmpFilesize
64KB
-
memory/1612-35-0x00000191274D0000-0x00000191274E0000-memory.dmpFilesize
64KB
-
memory/1612-36-0x0000019127510000-0x0000019127520000-memory.dmpFilesize
64KB
-
memory/1612-2-0x0000019127220000-0x0000019128220000-memory.dmpFilesize
16.0MB
-
memory/1612-13-0x00000191259B0000-0x00000191259B1000-memory.dmpFilesize
4KB
-
memory/1612-39-0x00000191274F0000-0x0000019127500000-memory.dmpFilesize
64KB
-
memory/1612-43-0x0000019127500000-0x0000019127510000-memory.dmpFilesize
64KB
-
memory/1612-62-0x0000019127220000-0x0000019128220000-memory.dmpFilesize
16.0MB
-
memory/3912-53-0x00000250EF180000-0x00000250EF181000-memory.dmpFilesize
4KB
-
memory/3912-54-0x00000250EF180000-0x00000250EF181000-memory.dmpFilesize
4KB
-
memory/3912-61-0x00000250EF420000-0x00000250EF430000-memory.dmpFilesize
64KB
-
memory/3912-60-0x00000250EF410000-0x00000250EF420000-memory.dmpFilesize
64KB
-
memory/3912-46-0x00000250EF1A0000-0x00000250F01A0000-memory.dmpFilesize
16.0MB
-
memory/3912-63-0x00000250EF1A0000-0x00000250F01A0000-memory.dmpFilesize
16.0MB