Analysis
-
max time kernel
158s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 01:58
Behavioral task
behavioral1
Sample
380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6.jar
Resource
win10v2004-20240226-en
General
-
Target
380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6.jar
-
Size
643KB
-
MD5
df2d12625998b7c51a4eab26d3a42e7e
-
SHA1
3d0403ab389c056beae99b7e71cca51ad521c870
-
SHA256
380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6
-
SHA512
af1ead62e893127323e6b86abad37ad804928bd96e9dbaac618cc737490efa0e61329d8dfb636fa9fd215596721ad04f3e63a2c04a909e895af8c08d02f1e75d
-
SSDEEP
12288:R/eAo7rK7tfAKc6Mr+DpxFGs/HfTeg1jPZc+AR6AptwyoFGVKBzG1KpUfsRxrq40:no7rKJcPr+wIHfzxcbTLwyoFuKBAURx4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
java.exewscript.exejavaw.exedescription pid process target process PID 2340 wrote to memory of 2832 2340 java.exe wscript.exe PID 2340 wrote to memory of 2832 2340 java.exe wscript.exe PID 2340 wrote to memory of 2832 2340 java.exe wscript.exe PID 2832 wrote to memory of 2428 2832 wscript.exe javaw.exe PID 2832 wrote to memory of 2428 2832 wscript.exe javaw.exe PID 2832 wrote to memory of 2428 2832 wscript.exe javaw.exe PID 2428 wrote to memory of 2620 2428 javaw.exe java.exe PID 2428 wrote to memory of 2620 2428 javaw.exe java.exe PID 2428 wrote to memory of 2620 2428 javaw.exe java.exe
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\380c08c3471775e3eccdcd3c755074457e7cdafc02e92e7b9ceaad8b500ea8a6.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript C:\Users\Admin\gcahfpmhcn.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\javaw.exe"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\uzyrot.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.06509658398445861343223690797938612.class4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_0.06509658398445861343223690797938612.classFilesize
241KB
MD5781fb531354d6f291f1ccab48da6d39f
SHA19ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA25697d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA5123e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-778096762-2241304387-192235952-1000\83aa4cc77f591dfc2374580bbd95f6ba_e942923e-bba7-4713-9a9e-94ded71626f5Filesize
45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
-
C:\Users\Admin\AppData\Roaming\uzyrot.txtFilesize
479KB
MD5d7d1131452a0427e78a2710d280537b5
SHA1279b601cb79c5d1790910c839125a45b2f43101d
SHA2564c81c42509988b29c4d77288ed55849de919676fbca4a938bf773f893f2e547e
SHA512483d03f5dcf0011679463a68f233cb50796c056d1045cc6eeaccae41ffbe51e562a186f6cd6196b0c3b63631553a7d780d6d77648117903e4d58238b2ef8d198
-
C:\Users\Admin\gcahfpmhcn.jsFilesize
1006KB
MD55bca887380e1881f351c22574d257e41
SHA1987634d53966aa6e84c72ad366bb78e619cb674a
SHA2565f4b5467cccbbc2f2c5771d9547e7fca350df341d154f4d83a4442b7a44cdf06
SHA51226c9da1464668a4d084095c4425f3e51c9c875e57315b8356081ab2ef032e5bfb28cbbef99d915dc626267c3abc9f8c134cae6778b5679e828fd55558946b92d
-
memory/2340-15-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2340-10-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/2340-9-0x00000000021F0000-0x00000000051F0000-memory.dmpFilesize
48.0MB
-
memory/2428-28-0x0000000002180000-0x0000000005180000-memory.dmpFilesize
48.0MB
-
memory/2428-37-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2428-57-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2428-61-0x0000000002180000-0x0000000005180000-memory.dmpFilesize
48.0MB
-
memory/2620-43-0x0000000002050000-0x0000000005050000-memory.dmpFilesize
48.0MB
-
memory/2620-47-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB