Analysis
-
max time kernel
298s -
max time network
303s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 16:48
Behavioral task
behavioral1
Sample
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
Resource
win7-20240221-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
Resource
win10-20240404-en
windows10-1703-x64
9 signatures
300 seconds
Behavioral task
behavioral3
Sample
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
Resource
win10v2004-20240419-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral4
Sample
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
Resource
win11-20240419-en
windows11-21h2-x64
7 signatures
300 seconds
General
-
Target
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
-
Size
64KB
-
MD5
5d16505a5abfcfc99095a676f1f0bd64
-
SHA1
facfb1f1014ba5f8c8618678a1a9a7f5bf5c35e5
-
SHA256
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d
-
SHA512
a49885eb60f6429c1247ae44bcf806836031a7191078a3b14b47c26b577bd2824d64ab17df8244361e114235600043188eae2794f58f299094976682865dc2cb
-
SSDEEP
1536:UNWRlwUsz/P+zKG2X2CWYqLvSUWD+YBFBbOl+H/Zm:UNisz/6YriYFfH/Zm
Score
10/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1844 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe Token: SeLoadDriverPrivilege 2596 WMIC.exe Token: SeSystemProfilePrivilege 2596 WMIC.exe Token: SeSystemtimePrivilege 2596 WMIC.exe Token: SeProfSingleProcessPrivilege 2596 WMIC.exe Token: SeIncBasePriorityPrivilege 2596 WMIC.exe Token: SeCreatePagefilePrivilege 2596 WMIC.exe Token: SeBackupPrivilege 2596 WMIC.exe Token: SeRestorePrivilege 2596 WMIC.exe Token: SeShutdownPrivilege 2596 WMIC.exe Token: SeDebugPrivilege 2596 WMIC.exe Token: SeSystemEnvironmentPrivilege 2596 WMIC.exe Token: SeRemoteShutdownPrivilege 2596 WMIC.exe Token: SeUndockPrivilege 2596 WMIC.exe Token: SeManageVolumePrivilege 2596 WMIC.exe Token: 33 2596 WMIC.exe Token: 34 2596 WMIC.exe Token: 35 2596 WMIC.exe Token: SeIncreaseQuotaPrivilege 2596 WMIC.exe Token: SeSecurityPrivilege 2596 WMIC.exe Token: SeTakeOwnershipPrivilege 2596 WMIC.exe Token: SeLoadDriverPrivilege 2596 WMIC.exe Token: SeSystemProfilePrivilege 2596 WMIC.exe Token: SeSystemtimePrivilege 2596 WMIC.exe Token: SeProfSingleProcessPrivilege 2596 WMIC.exe Token: SeIncBasePriorityPrivilege 2596 WMIC.exe Token: SeCreatePagefilePrivilege 2596 WMIC.exe Token: SeBackupPrivilege 2596 WMIC.exe Token: SeRestorePrivilege 2596 WMIC.exe Token: SeShutdownPrivilege 2596 WMIC.exe Token: SeDebugPrivilege 2596 WMIC.exe Token: SeSystemEnvironmentPrivilege 2596 WMIC.exe Token: SeRemoteShutdownPrivilege 2596 WMIC.exe Token: SeUndockPrivilege 2596 WMIC.exe Token: SeManageVolumePrivilege 2596 WMIC.exe Token: 33 2596 WMIC.exe Token: 34 2596 WMIC.exe Token: 35 2596 WMIC.exe Token: SeIncreaseQuotaPrivilege 2768 WMIC.exe Token: SeSecurityPrivilege 2768 WMIC.exe Token: SeTakeOwnershipPrivilege 2768 WMIC.exe Token: SeLoadDriverPrivilege 2768 WMIC.exe Token: SeSystemProfilePrivilege 2768 WMIC.exe Token: SeSystemtimePrivilege 2768 WMIC.exe Token: SeProfSingleProcessPrivilege 2768 WMIC.exe Token: SeIncBasePriorityPrivilege 2768 WMIC.exe Token: SeCreatePagefilePrivilege 2768 WMIC.exe Token: SeBackupPrivilege 2768 WMIC.exe Token: SeRestorePrivilege 2768 WMIC.exe Token: SeShutdownPrivilege 2768 WMIC.exe Token: SeDebugPrivilege 2768 WMIC.exe Token: SeSystemEnvironmentPrivilege 2768 WMIC.exe Token: SeRemoteShutdownPrivilege 2768 WMIC.exe Token: SeUndockPrivilege 2768 WMIC.exe Token: SeManageVolumePrivilege 2768 WMIC.exe Token: 33 2768 WMIC.exe Token: 34 2768 WMIC.exe Token: 35 2768 WMIC.exe Token: SeIncreaseQuotaPrivilege 2768 WMIC.exe Token: SeSecurityPrivilege 2768 WMIC.exe Token: SeTakeOwnershipPrivilege 2768 WMIC.exe Token: SeLoadDriverPrivilege 2768 WMIC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1992 1968 java.exe 29 PID 1968 wrote to memory of 1992 1968 java.exe 29 PID 1968 wrote to memory of 1992 1968 java.exe 29 PID 1968 wrote to memory of 1704 1968 java.exe 30 PID 1968 wrote to memory of 1704 1968 java.exe 30 PID 1968 wrote to memory of 1704 1968 java.exe 30 PID 1992 wrote to memory of 1844 1992 cmd.exe 31 PID 1992 wrote to memory of 1844 1992 cmd.exe 31 PID 1992 wrote to memory of 1844 1992 cmd.exe 31 PID 1704 wrote to memory of 2584 1704 java.exe 32 PID 1704 wrote to memory of 2584 1704 java.exe 32 PID 1704 wrote to memory of 2584 1704 java.exe 32 PID 2584 wrote to memory of 2596 2584 cmd.exe 33 PID 2584 wrote to memory of 2596 2584 cmd.exe 33 PID 2584 wrote to memory of 2596 2584 cmd.exe 33 PID 1704 wrote to memory of 2300 1704 java.exe 35 PID 1704 wrote to memory of 2300 1704 java.exe 35 PID 1704 wrote to memory of 2300 1704 java.exe 35 PID 2300 wrote to memory of 2768 2300 cmd.exe 36 PID 2300 wrote to memory of 2768 2300 cmd.exe 36 PID 2300 wrote to memory of 2768 2300 cmd.exe 36 PID 1704 wrote to memory of 2548 1704 java.exe 37 PID 1704 wrote to memory of 2548 1704 java.exe 37 PID 1704 wrote to memory of 2548 1704 java.exe 37 PID 2548 wrote to memory of 2404 2548 cmd.exe 38 PID 2548 wrote to memory of 2404 2548 cmd.exe 38 PID 2548 wrote to memory of 2404 2548 cmd.exe 38 PID 1704 wrote to memory of 2516 1704 java.exe 39 PID 1704 wrote to memory of 2516 1704 java.exe 39 PID 1704 wrote to memory of 2516 1704 java.exe 39 PID 2516 wrote to memory of 2424 2516 cmd.exe 40 PID 2516 wrote to memory of 2424 2516 cmd.exe 40 PID 2516 wrote to memory of 2424 2516 cmd.exe 40 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"3⤵
- Creates scheduled task(s)
PID:1844
-
-
-
C:\Program Files\Java\jre7\bin\java.exe"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵PID:2404
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list4⤵PID:2424
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
Filesize64KB
MD55d16505a5abfcfc99095a676f1f0bd64
SHA1facfb1f1014ba5f8c8618678a1a9a7f5bf5c35e5
SHA25639694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d
SHA512a49885eb60f6429c1247ae44bcf806836031a7191078a3b14b47c26b577bd2824d64ab17df8244361e114235600043188eae2794f58f299094976682865dc2cb