59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FEDEX-TNT OVERDUE UNPAID INVOICE980055177856..jar
Size 634KB
Sample240416-tmx2naed98
SHA256 59ea95bf89900dadb2e085d910bd72f71239a11b01c7f4c5e8feb0aea1a2c1d9
MD5 979ba6af6f6adf0930ab75ecea1b450f
SHA1 1153c96b460ca99ecb21fd4eb3b90919ba827e90
SHA512 fd50d7b463ecd2c76afcf677512f6e789e0ccd44056c90a8b5096c8a1d9c09e7b1da5d0abb98c5018ec23faeb559cd2b674e43f5cfe69fb1846e4cd7e6167818
SSDEEP 12288:FkQrFVhCTXI38nXLt1+VmnBcN+b/bYBGs4Ty0qZBZUjWzdNkE7LKJU27DG:v/hkYWbtqmnucbFIUjWzdJLKJU27DG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3924	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3104	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 3924	4336	java.exe	89
PID 4336 wrote to memory of 3924	4336	java.exe	89
PID 4336 wrote to memory of 4216	4336	java.exe	91
PID 4336 wrote to memory of 4216	4336	java.exe	91
PID 4216 wrote to memory of 3504	4216	wscript.exe	92
PID 4216 wrote to memory of 3504	4216	wscript.exe	92
PID 3504 wrote to memory of 3104	3504	javaw.exe	94
PID 3504 wrote to memory of 3104	3504	javaw.exe	94

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\FEDEX-TNT OVERDUE UNPAID INVOICE980055177856..jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3924
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\gdaluemxai.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\sfcwtjkny.txt"
    3⤵
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.17936033841084128258948480847111730.class
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 2a19f57d037b79a6dce12a88a1e178e78400d8e28d6b48abbe59467fc012de2a
MD5 b22ade4685d201ad55fb9bbc77beb2e2
SHA1 826dc5518643215c56ef8176f7a150f0860c3b2b
SHA512 9a61d0fdb7071140d3fbb030e0fab0c1c855788afa1727d01c232ee0b7f7d699ff94003cd0e782af525fe34d8fa6a6a3b5b58a6f78e6dc0ec036b96836075605
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 329a9c92c97ae9abe989ae975bfce87c4c92f37428f8c6a163a25bf37dbb0a57
MD5 9bb557fa3e95d80847aaa411845ec921
SHA1 d998b30a3dcefd2b26774f5b6c295b07caefa986
SHA512 db96fc49877c2044283f9a281c501e8c7f17475c502638e95b37aa093d14365101ba8d2f3d9b116df76fd06ff9f4c97614796df0bc1101ff8b294ff3ba28eedc
MD5 SHA1 SHA512

Submit Download

_0.17936033841084128258948480847111730.class

Path C:\Users\Admin\AppData\Local\Temp\_0.17936033841084128258948480847111730.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_338e918a-08d3-477c-81e2-0f9a71d72db8

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4084619521-2220719027-1909462854-1000\83aa4cc77f591dfc2374580bbd95f6ba_338e918a-08d3-477c-81e2-0f9a71d72db8
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

sfcwtjkny.txt

Path C:\Users\Admin\AppData\Roaming\sfcwtjkny.txt
Size 479KB
SHA256 4c81c42509988b29c4d77288ed55849de919676fbca4a938bf773f893f2e547e
MD5 d7d1131452a0427e78a2710d280537b5
SHA1 279b601cb79c5d1790910c839125a45b2f43101d
SHA512 483d03f5dcf0011679463a68f233cb50796c056d1045cc6eeaccae41ffbe51e562a186f6cd6196b0c3b63631553a7d780d6d77648117903e4d58238b2ef8d198
SSDEEP 12288:x8h4GbbFN8rQO/rATlnt85pxogQNUhIK/0c2qnAU:x83T88O/NsS7B2qnl
MD5 SHA1 SHA512 SSDEEP

Submit Download

gdaluemxai.js

Path C:\Users\Admin\gdaluemxai.js
Size 967KB
SHA256 31853f11736946284924a38229539824a3a950d941c5306599d8c7756d257a52
MD5 6486154cf2e7d01b5d636ba9d025f99d
SHA1 02a43f850ca142335a6d09f589b1dd3cc714e6f8
SHA512 4518aa46409a21401adb6a93da32785911559d41492d1e2dad7b7e5dffec183f6d8dcd16064f09d3ed4ab1b2b9e60f5d9726a22cc5d2faa7200c4308f2cb1ebe
SSDEEP 12288:kkosJPkGdFz2zC6ewUuoUuaWyeXxgSY2CzuKdqlRnrCvj0zclNARZ7p4j3X6eJYp:kxakGvzluoYW6tdqLwUcjAr947KeOUw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3104-70-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3104-68-0x00000265F7410000-0x00000265F7411000-memory.dmp

Download

memory/3104-97-0x00000265F7410000-0x00000265F7411000-memory.dmp

Download

memory/3104-98-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3104-50-0x00000265F7410000-0x00000265F7411000-memory.dmp

Download

memory/3104-39-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3104-93-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3104-86-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3104-80-0x00000265F7410000-0x00000265F7411000-memory.dmp

Download

memory/3104-75-0x0000026580000000-0x0000026581000000-memory.dmp

Download

memory/3504-54-0x00000189CAAA0000-0x00000189CBAA0000-memory.dmp

Download

memory/3504-61-0x00000189CAD30000-0x00000189CAD40000-memory.dmp

Download

memory/3504-65-0x00000189CAD50000-0x00000189CAD60000-memory.dmp

Download

memory/3504-63-0x00000189CAD40000-0x00000189CAD50000-memory.dmp

Download

memory/3504-59-0x00000189CAD20000-0x00000189CAD30000-memory.dmp

Download

memory/3504-24-0x00000189CAAA0000-0x00000189CBAA0000-memory.dmp

Download

memory/3504-40-0x00000189CAA80000-0x00000189CAA81000-memory.dmp

Download

memory/4336-4-0x000001AED1000000-0x000001AED2000000-memory.dmp

Download

memory/4336-12-0x000001AECF810000-0x000001AECF811000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads