Overview

overview

10

Static

static

10

39694a3902...7d.jar

windows7-x64

10

39694a3902...7d.jar

windows10-1703-x64

10

39694a3902...7d.jar

windows10-2004-x64

10

39694a3902...7d.jar

windows11-21h2-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    307s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-04-2024 16:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar

  • Size

    64KB

  • MD5

    5d16505a5abfcfc99095a676f1f0bd64

  • SHA1

    facfb1f1014ba5f8c8618678a1a9a7f5bf5c35e5

  • SHA256

    39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d

  • SHA512

    a49885eb60f6429c1247ae44bcf806836031a7191078a3b14b47c26b577bd2824d64ab17df8244361e114235600043188eae2794f58f299094976682865dc2cb

  • SSDEEP

    1536:UNWRlwUsz/P+zKG2X2CWYqLvSUWD+YBFBbOl+H/Zm:UNisz/6YriYFfH/Zm

Score
10/10
strratdiscoverypersistencestealertrojan

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Drops startup file 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4988
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"
        3⤵
        • Creates scheduled task(s)
        PID:4876
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2340
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5000
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
          4⤵
            PID:4412
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list
            4⤵
              PID:2376

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
        Filesize

        64KB

        MD5

        5d16505a5abfcfc99095a676f1f0bd64

        SHA1

        facfb1f1014ba5f8c8618678a1a9a7f5bf5c35e5

        SHA256

        39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d

        SHA512

        a49885eb60f6429c1247ae44bcf806836031a7191078a3b14b47c26b577bd2824d64ab17df8244361e114235600043188eae2794f58f299094976682865dc2cb

        Download Submit

      • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
        Filesize

        46B

        MD5

        5f9cfa6bb68097c69b8db51363d448f9

        SHA1

        d79cfa1ed4f2f7cb0e195fe54386be082f756a24

        SHA256

        cd8750040b479cb5f0328f717e14427b7b011189756208ce92c1cf49dd64bfa7

        SHA512

        590a24755a95aeca4bfb4d785b46edef746037e4edecd34410ca14d3eb09bb8b9761aa8b7d49f833c9ce754b8e5a463ff82e6472715d8fb09840bbeed6a96594

        Download Submit

      • memory/3668-28-0x000001D354790000-0x000001D3547A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3668-32-0x000001D3547E0000-0x000001D3547F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3668-12-0x000001D3544F0000-0x000001D3544F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3668-31-0x000001D3547B0000-0x000001D3547C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3668-30-0x000001D3547A0000-0x000001D3547B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3668-29-0x000001D3547C0000-0x000001D3547D0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3668-8-0x000001D354510000-0x000001D355510000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/3668-21-0x000001D354510000-0x000001D355510000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/3668-38-0x000001D354510000-0x000001D355510000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/3668-60-0x000001D354510000-0x000001D355510000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/4584-46-0x00000227D9760000-0x00000227D9761000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4584-54-0x00000227D9760000-0x00000227D9761000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4584-56-0x00000227D9760000-0x00000227D9761000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4584-45-0x00000227D9780000-0x00000227DA780000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/4584-61-0x00000227D9780000-0x00000227DA780000-memory.dmp

        Filesize

        16.0MB

        Download