Analysis
-
max time kernel
39s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 12:18
Behavioral task
behavioral1
Sample
293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar
Resource
win10v2004-20240226-en
General
-
Target
293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar
-
Size
634KB
-
MD5
d5a37c856d0e9668881e2b16bd467d16
-
SHA1
ebda2eab3ac988d7819c75f6ab189d498c927c17
-
SHA256
293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f
-
SHA512
520a9790d791683c26ef68fef5d98b0051ac902b76d93586feb5617bdfd84f239e35c0287d4d2da0ff28439166e6cc06b5d14abac88007919e6d655360036f63
-
SSDEEP
12288:QdEThNA1mApKnMcL0mcjkJyiS5jUjClC/+jp5Uam2G+hJDW:Og7AsAEnMcL0DjksiSJmClCo3xGu1W
Malware Config
Signatures
-
Ratty Rat payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar family_ratty -
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar java.exe -
Loads dropped DLL 1 IoCs
Processes:
java.exepid process 2168 java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
REG.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar = "C:\\Users\\Admin\\AppData\\Roaming\\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar" REG.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
java.exepid process 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe 2168 java.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.exedescription pid process target process PID 2168 wrote to memory of 1172 2168 java.exe icacls.exe PID 2168 wrote to memory of 1172 2168 java.exe icacls.exe PID 2168 wrote to memory of 5060 2168 java.exe REG.exe PID 2168 wrote to memory of 5060 2168 java.exe REG.exe PID 2168 wrote to memory of 1944 2168 java.exe attrib.exe PID 2168 wrote to memory of 1944 2168 java.exe attrib.exe PID 2168 wrote to memory of 2592 2168 java.exe attrib.exe PID 2168 wrote to memory of 2592 2168 java.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1944 attrib.exe 2592 attrib.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar" /d "C:\Users\Admin\AppData\Roaming\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jar2⤵
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD50955ff2fd8147527517a457a9f1b31ce
SHA12c49663b76fce580061fb4a343dacde744ad64ce
SHA256d3abe04ea20551e0681592b20188e24a3be146978466220bed5d30198f338bdf
SHA512f7aeafe0c93477ecde36835eaaaa3532495f1c45c8c2582d42448b931d343ec9c987c601b4f9e4128d9c27329c6429ef1a00061fbc344184b2fd61084457a42a
-
C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dllFilesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
C:\Users\Admin\AppData\Roaming\293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f.jarFilesize
634KB
MD5d5a37c856d0e9668881e2b16bd467d16
SHA1ebda2eab3ac988d7819c75f6ab189d498c927c17
SHA256293bb44126b4c7b7a49822d7a10e873f57daba7c2e4c4a9116bc28659d03744f
SHA512520a9790d791683c26ef68fef5d98b0051ac902b76d93586feb5617bdfd84f239e35c0287d4d2da0ff28439166e6cc06b5d14abac88007919e6d655360036f63
-
memory/2168-2-0x0000013E9E360000-0x0000013E9F360000-memory.dmpFilesize
16.0MB
-
memory/2168-12-0x0000013E9CA80000-0x0000013E9CA81000-memory.dmpFilesize
4KB
-
memory/2168-19-0x0000013E9CA80000-0x0000013E9CA81000-memory.dmpFilesize
4KB
-
memory/2168-30-0x0000013E9CA80000-0x0000013E9CA81000-memory.dmpFilesize
4KB
-
memory/2168-32-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB
-
memory/2168-34-0x0000000065E40000-0x0000000065E55000-memory.dmpFilesize
84KB