af81551ceb897d30262d1e026c726cca1c557432ef3941517d52ba0c729ee390

Analysis

max time kernel
121s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HSBCPAYMENTINFORMATION.jar
Size 323KB
Sample240422-wpqfpsed3v
SHA256 af81551ceb897d30262d1e026c726cca1c557432ef3941517d52ba0c729ee390
MD5 8bc5d958958ecbd730d7dda1944df217
SHA1 ba085c5a31c068fc091e5bcdb1053a3361fcab3a
SHA512 0e5756f0ad4f4ac9d7b6f58457544c070f10bc4f47f24d0d46180bdf4d29de4d3cdba25030acf9aad4c2fe91bbd06d1696bf5fbd17f6911b74256a947036e374
SSDEEP 6144:ONxOYNczJ2hrMeMS37wnjKqIbYUaQ5EpI11qvzA8E2or7JxDia+cdicoJc9X:0QYczJWYo7weqIbP/5EW11qP4r7JxDy4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3712	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 3712	3652	java.exe	88
PID 3652 wrote to memory of 3712	3652	java.exe	88
PID 3652 wrote to memory of 3076	3652	java.exe	90
PID 3652 wrote to memory of 3076	3652	java.exe	90
PID 3076 wrote to memory of 3532	3076	wscript.exe	91
PID 3076 wrote to memory of 3532	3076	wscript.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\HSBCPAYMENTINFORMATION.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3712
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\pdjyzlpvxe.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\bnmiixcl.txt"
    3⤵
    - Drops file in Program Files directory
    PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 8067fa76a007b1cc0e7c145d491ce13c3d5752c683429b8b0152294bfcc070c7
MD5 6897760283254339fd31e4b497d1ffbd
SHA1 5af1a599ab552c4342a2266cadfe113bd56cabf9
SHA512 bb3a031302fdceed80821de76103db4f4113b51c13742fafee19feb9e19c1bebba593fcbed97e20a063e71daf4ae8a9623ab6eb578689da5ca7ae0d12f9c496b
MD5 SHA1 SHA512

Submit Download

bnmiixcl.txt

Path C:\Users\Admin\AppData\Roaming\bnmiixcl.txt
Size 164KB
SHA256 1a1440b6c0a38795622986389f8b7cf63308a6dbedf739193b4ac1afeb3cb75a
MD5 00e1c2df748956d40fd13287926579ed
SHA1 3a92e09d292ccb09d00cefdc356a5c727f70d863
SHA512 ce30790fd705cda6e00177290734634ffa3602c7c3071c6220de1dcfa68d80c66254945624354f45668d0d9a3bb7abb8cd6803d0291447ae84d20b8d6f233084
SSDEEP 3072:cw1hM3HYEmfdE+9/6YJu9TCrkJGOxSY0KOM4r0xNFXz0x9Al65Hv:chUf+Yu9TPJGOxr0q/F4x944P
MD5 SHA1 SHA512 SSDEEP

Submit Download

pdjyzlpvxe.js

Path C:\Users\Admin\pdjyzlpvxe.js
Size 1.4MB
SHA256 cba0b00fee9d0a7fea607b8ddbb69c8ec199e5c912e5478ef1df19798dea2c54
MD5 7d4ac63022f6f499138fec47655f7db4
SHA1 d7494806d991a807240b322db57c21c8f7fe3e4f
SHA512 7e9888c49d4016eb8e635ab74a37ad68d3e635f2ceb4b4d21d1287338a61035fca264378a2e5c96602b043e1421934e0bd5bce06ca888847f8978a8a5844af3a
SSDEEP 6144:DQf+kgvqUkBTgXB3/kOtPlJ8U3yyfauoAgKeCs2WhihiRLF7afIg3wbAwq7G/T/R:kR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3532-54-0x0000024205900000-0x0000024205910000-memory.dmp

Download

memory/3532-55-0x0000024205910000-0x0000024205920000-memory.dmp

Download

memory/3532-22-0x0000024205600000-0x0000024206600000-memory.dmp

Download

memory/3532-29-0x0000024203DC0000-0x0000024203DC1000-memory.dmp

Download

memory/3532-36-0x0000024205600000-0x0000024206600000-memory.dmp

Download

memory/3532-45-0x0000024203DC0000-0x0000024203DC1000-memory.dmp

Download

memory/3532-52-0x0000024205600000-0x0000024206600000-memory.dmp

Download

memory/3532-61-0x0000024205600000-0x0000024206600000-memory.dmp

Download

memory/3532-53-0x0000024205890000-0x00000242058A0000-memory.dmp

Download

memory/3532-60-0x0000024205600000-0x0000024206600000-memory.dmp

Download

memory/3532-56-0x00000242058B0000-0x00000242058C0000-memory.dmp

Download

memory/3532-51-0x0000024205880000-0x0000024205890000-memory.dmp

Download

memory/3532-57-0x00000242058C0000-0x00000242058D0000-memory.dmp

Download

memory/3532-58-0x00000242058D0000-0x00000242058E0000-memory.dmp

Download

memory/3532-59-0x00000242058E0000-0x00000242058F0000-memory.dmp

Download

memory/3652-14-0x0000021AE4970000-0x0000021AE4971000-memory.dmp

Download

memory/3652-4-0x0000021AE6300000-0x0000021AE7300000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads