Analysis
- max time kernel
300s - max time network
307s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
28/04/2024, 16:48
General
- Target 39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
- Size 64KB
- Sample240428-vbge7scb78
- SHA256 39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"3⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
39694a390267d62c814460cb461426a78d3d43a701f5877896c8cbec48c7827d.jar
3903daac9bc4a3b7.timestamp
memory/3668-28-0x000001D354790000-0x000001D3547A0000-memory.dmp
memory/3668-32-0x000001D3547E0000-0x000001D3547F0000-memory.dmp
memory/3668-12-0x000001D3544F0000-0x000001D3544F1000-memory.dmp
memory/3668-31-0x000001D3547B0000-0x000001D3547C0000-memory.dmp
memory/3668-30-0x000001D3547A0000-0x000001D3547B0000-memory.dmp
memory/3668-29-0x000001D3547C0000-0x000001D3547D0000-memory.dmp
memory/3668-8-0x000001D354510000-0x000001D355510000-memory.dmp
memory/3668-21-0x000001D354510000-0x000001D355510000-memory.dmp
memory/3668-38-0x000001D354510000-0x000001D355510000-memory.dmp
memory/3668-60-0x000001D354510000-0x000001D355510000-memory.dmp
memory/4584-46-0x00000227D9760000-0x00000227D9761000-memory.dmp
memory/4584-54-0x00000227D9760000-0x00000227D9761000-memory.dmp
memory/4584-56-0x00000227D9760000-0x00000227D9761000-memory.dmp
memory/4584-45-0x00000227D9780000-0x00000227DA780000-memory.dmp
memory/4584-61-0x00000227D9780000-0x00000227DA780000-memory.dmp