Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2024 02:27
Behavioral task
behavioral1
Sample
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar
Resource
win10v2004-20240226-en
General
-
Target
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar
-
Size
64KB
-
MD5
c5ccda6e6a108412c4c34cd17f3b421d
-
SHA1
e9d90ce1bc7881a45cea1a583ce41724f31310d2
-
SHA256
adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
-
SHA512
1d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
SSDEEP
1536:grXv/fcVMHH45ofDI4extOPLjOU09xJ9d3W4U0w:gL/xHY5SStOPLjwM4U3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar\"" java.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar\"" java.exe -
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 4284 wrote to memory of 4860 4284 java.exe icacls.exe PID 4284 wrote to memory of 4860 4284 java.exe icacls.exe PID 4284 wrote to memory of 2896 4284 java.exe cmd.exe PID 4284 wrote to memory of 2896 4284 java.exe cmd.exe PID 4284 wrote to memory of 2952 4284 java.exe java.exe PID 4284 wrote to memory of 2952 4284 java.exe java.exe PID 2896 wrote to memory of 5044 2896 cmd.exe schtasks.exe PID 2896 wrote to memory of 5044 2896 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar"3⤵
- Creates scheduled task(s)
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jar"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56.jarFilesize
64KB
MD5c5ccda6e6a108412c4c34cd17f3b421d
SHA1e9d90ce1bc7881a45cea1a583ce41724f31310d2
SHA256adb3339242b796ed48346e8d3228c8d3157ea01fbbf1590f3dbd255d62036b56
SHA5121d7c10bfe158fa0c75750353ebd9102afcf3f74643d2a41f7ff8563b89bc395ca3470850d8fd84cd6a1d41c8cc2e0c2ab7b2f7a4979a481bd5492c8a591fa47e
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD596dce46d58f49e14d19edf4c6bdc9d7f
SHA1d2fffe37751e7f15dad37a688dc4c44f5598c224
SHA256b0af15c5a91a51df1871ebd226fd62930c00bc4062caeb67622f2b483b249285
SHA512f67341ee421f79a8c1c191c7902f64493709d18dd3671ed8e46035402b4a4e087eb576ea3646cf276aef12062b9622e7321d168199f73c0897a2a63c218115a4
-
memory/2952-54-0x000002B1277A0000-0x000002B1287A0000-memory.dmpFilesize
16.0MB
-
memory/2952-52-0x000002B1277A0000-0x000002B1287A0000-memory.dmpFilesize
16.0MB
-
memory/2952-43-0x000002B1277A0000-0x000002B1287A0000-memory.dmpFilesize
16.0MB
-
memory/4284-23-0x0000020681AA0000-0x0000020682AA0000-memory.dmpFilesize
16.0MB
-
memory/4284-31-0x0000020681D20000-0x0000020681D30000-memory.dmpFilesize
64KB
-
memory/4284-32-0x0000020681D80000-0x0000020681D90000-memory.dmpFilesize
64KB
-
memory/4284-33-0x0000020681D40000-0x0000020681D50000-memory.dmpFilesize
64KB
-
memory/4284-34-0x0000020681D50000-0x0000020681D60000-memory.dmpFilesize
64KB
-
memory/4284-35-0x0000020681D60000-0x0000020681D70000-memory.dmpFilesize
64KB
-
memory/4284-38-0x0000020681AA0000-0x0000020682AA0000-memory.dmpFilesize
16.0MB
-
memory/4284-4-0x0000020681AA0000-0x0000020682AA0000-memory.dmpFilesize
16.0MB
-
memory/4284-17-0x0000020681AA0000-0x0000020682AA0000-memory.dmpFilesize
16.0MB
-
memory/4284-53-0x0000020681AA0000-0x0000020682AA0000-memory.dmpFilesize
16.0MB
-
memory/4284-15-0x0000020681A80000-0x0000020681A81000-memory.dmpFilesize
4KB