Analysis
-
max time kernel
115s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 18:47
Static task
static1
Behavioral task
behavioral1
Sample
Tax_documents_JPG.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Tax_documents_JPG.jar
Resource
win10v2004-20240226-en
General
-
Target
Tax_documents_JPG.jar
-
Size
429KB
-
MD5
b600058b62cbca0ace1c87e4dc1eab56
-
SHA1
16cfb0fbf7fa4b821c6313a9512f1b04aa693813
-
SHA256
811de6570cf64d430a2c0af6fd2ce4214e61d5fd6f7adaae6d1bf4791b4d11e0
-
SHA512
af0e7c3d18b659204b7b78ec948feeae04e47d4d0210ef32833278d078fbe6f3d8a9de3cdd8364e7f4b89dec372cd47dbde4d478c9b78641c080301490936d82
-
SSDEEP
6144:LxHPsAEkCqNL+MbHEMVw4zYr/mglY20Ozj/fjRs+Cxd32oSTklkCNPaawJzkfpSy:ekCqPkgpsr/JzynSTtir0usYPuJ6Aax
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\bwyxdhy.txt family_ratty -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
javaw.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bwyxdhy.txt javaw.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bwyxdhy.txt javaw.exe -
Loads dropped DLL 1 IoCs
Processes:
javaw.exepid process 4656 javaw.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REG.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bwyxdhy.txt = "C:\\Users\\Admin\\AppData\\Roaming\\bwyxdhy.txt" REG.exe -
Drops file in Program Files directory 12 IoCs
Processes:
javaw.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb javaw.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb javaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
javaw.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ javaw.exe Key created \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ javaw.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
javaw.exepid process 4656 javaw.exe 4656 javaw.exe 4656 javaw.exe 4656 javaw.exe 4656 javaw.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
java.exewscript.exejavaw.exedescription pid process target process PID 3792 wrote to memory of 1328 3792 java.exe icacls.exe PID 3792 wrote to memory of 1328 3792 java.exe icacls.exe PID 3792 wrote to memory of 1896 3792 java.exe wscript.exe PID 3792 wrote to memory of 1896 3792 java.exe wscript.exe PID 1896 wrote to memory of 4656 1896 wscript.exe javaw.exe PID 1896 wrote to memory of 4656 1896 wscript.exe javaw.exe PID 4656 wrote to memory of 4636 4656 javaw.exe REG.exe PID 4656 wrote to memory of 4636 4656 javaw.exe REG.exe PID 4656 wrote to memory of 1432 4656 javaw.exe attrib.exe PID 4656 wrote to memory of 1432 4656 javaw.exe attrib.exe PID 4656 wrote to memory of 2976 4656 javaw.exe attrib.exe PID 4656 wrote to memory of 2976 4656 javaw.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2976 attrib.exe 1432 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Tax_documents_JPG.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\wscript.exewscript C:\Users\Admin\rideaegdny.js2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bwyxdhy.txt"3⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "bwyxdhy.txt" /d "C:\Users\Admin\AppData\Roaming\bwyxdhy.txt" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\bwyxdhy.txt4⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bwyxdhy.txt4⤵
- Views/modifies file attributes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2700 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5bb14bb95bf3914eb94ae4a1cdeb7392c
SHA15fc20d4ef0403c479bf16b55a3773bd725fd5e00
SHA256bb8c2f4876ffc0dcdb85af153e6fcdfd7b7a652c5d5094034daf4867b4fea54d
SHA51279ae397fddc1c859e4a4dcd633813d192b0d85a0871d316751db9055580f5d510b3208789e3b96b8767d96c9710e071c4d1c4e7b1aecd6e6040c1d4c9964f94f
-
C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dllFilesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
C:\Users\Admin\AppData\Roaming\bwyxdhy.txtFilesize
332KB
MD500694ae146ab43cc057084110f747e4c
SHA167a24c66fac1fdf2cd98b536768597ab1c03c8f1
SHA256248a66690549491b314b81e4375b6ad856866183df59ee9e1bf3872c5eb1689b
SHA51203440417eb6dec4c64d35b1c2694d5fc2e145262b1c044d9ab950625368c2a44c3f09504e6233b684846e55801e685465b8b2ec162a7e66e693a384e73f1ef3b
-
C:\Users\Admin\rideaegdny.jsFilesize
720KB
MD56eee7d7c5b76c9e009b9ef36d28f2769
SHA1a0c9a8eaad86685900d0127eba6e43a0808cf2a8
SHA2561058268338b671fdad899ed250b792ce2e587fc2686375f1d931dca2a8c6a7c8
SHA5121eeca587292603dc86ff12d07c0e54798cdf88abf2227d3ec11bf2b3bdea47add1760c1c79e856110d200abcc0bd68aeb27807f7bbe051e4731717e8ed4947c9
-
memory/3792-4-0x000001BC80000000-0x000001BC81000000-memory.dmpFilesize
16.0MB
-
memory/3792-14-0x000001BCFBF60000-0x000001BCFBF61000-memory.dmpFilesize
4KB
-
memory/4656-33-0x000002753AE20000-0x000002753AE21000-memory.dmpFilesize
4KB
-
memory/4656-28-0x000002753C660000-0x000002753D660000-memory.dmpFilesize
16.0MB
-
memory/4656-45-0x000002753AE20000-0x000002753AE21000-memory.dmpFilesize
4KB
-
memory/4656-48-0x000002753C660000-0x000002753D660000-memory.dmpFilesize
16.0MB
-
memory/4656-50-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB
-
memory/4656-51-0x000002753C8E0000-0x000002753C8F0000-memory.dmpFilesize
64KB
-
memory/4656-52-0x000002753C660000-0x000002753D660000-memory.dmpFilesize
16.0MB