Analysis
- max time kernel
1193s - max time network
1203s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
29/05/2024, 11:44
General
- Target Telex copy.pdf.jar
- Size 547KB
- Sample240529-nwad3adb71
- SHA256 3fe4e6a766fe9c2ef1351917f9c231c714def28e8c1d42a1f75d0a664f719507
Malware Config
Signatures
- STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
- Drops startup file 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Telex copy.pdf.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\Telex copy.pdf.jar"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Telex copy.pdf.jar"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Telex copy.pdf.jar"4⤵
- Creates scheduled task(s)
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Telex copy.pdf.jar"3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Telex copy.pdf.jar
jna-platform-5.5.0.jar
sqlite-jdbc-3.14.2.1.jar
system-hook-3.5.jar
memory/1448-126-0x00000239086F0000-0x0000023908700000-memory.dmp
memory/1448-55-0x0000023908660000-0x0000023908670000-memory.dmp
memory/1448-18-0x0000023908590000-0x00000239085A0000-memory.dmp
memory/1448-16-0x0000023908580000-0x0000023908590000-memory.dmp
memory/1448-15-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-19-0x00000239085A0000-0x00000239085B0000-memory.dmp
memory/1448-21-0x00000239085B0000-0x00000239085C0000-memory.dmp
memory/1448-24-0x00000239085C0000-0x00000239085D0000-memory.dmp
memory/1448-25-0x00000239085D0000-0x00000239085E0000-memory.dmp
memory/1448-172-0x0000023908730000-0x0000023908740000-memory.dmp
memory/1448-30-0x00000239085F0000-0x0000023908600000-memory.dmp
memory/1448-29-0x0000023908310000-0x0000023908580000-memory.dmp
memory/1448-32-0x0000023908600000-0x0000023908610000-memory.dmp
memory/1448-34-0x0000023908610000-0x0000023908620000-memory.dmp
memory/1448-36-0x0000023908620000-0x0000023908630000-memory.dmp
memory/1448-43-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-44-0x0000023908580000-0x0000023908590000-memory.dmp
memory/1448-45-0x0000023908590000-0x00000239085A0000-memory.dmp
memory/1448-46-0x0000023908630000-0x0000023908640000-memory.dmp
memory/1448-50-0x0000023908640000-0x0000023908650000-memory.dmp
memory/1448-49-0x00000239085A0000-0x00000239085B0000-memory.dmp
memory/1448-52-0x0000023908650000-0x0000023908660000-memory.dmp
memory/1448-51-0x00000239085B0000-0x00000239085C0000-memory.dmp
memory/1448-54-0x00000239085C0000-0x00000239085D0000-memory.dmp
memory/1448-174-0x0000023908740000-0x0000023908750000-memory.dmp
memory/1448-58-0x00000239085D0000-0x00000239085E0000-memory.dmp
memory/1448-59-0x0000023908670000-0x0000023908680000-memory.dmp
memory/1448-61-0x0000023908680000-0x0000023908690000-memory.dmp
memory/1448-60-0x00000239085E0000-0x00000239085F0000-memory.dmp
memory/1448-66-0x0000023908600000-0x0000023908610000-memory.dmp
memory/1448-64-0x00000239085F0000-0x0000023908600000-memory.dmp
memory/1448-65-0x0000023908690000-0x00000239086A0000-memory.dmp
memory/1448-67-0x00000239086A0000-0x00000239086B0000-memory.dmp
memory/1448-70-0x00000239086B0000-0x00000239086C0000-memory.dmp
memory/1448-69-0x0000023908610000-0x0000023908620000-memory.dmp
memory/1448-73-0x00000239086C0000-0x00000239086D0000-memory.dmp
memory/1448-72-0x0000023908620000-0x0000023908630000-memory.dmp
memory/1448-78-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-166-0x0000023908720000-0x0000023908730000-memory.dmp
memory/1448-87-0x00000239086D0000-0x00000239086E0000-memory.dmp
memory/1448-109-0x0000023908640000-0x0000023908650000-memory.dmp
memory/1448-110-0x00000239086E0000-0x00000239086F0000-memory.dmp
memory/1448-113-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-116-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-147-0x0000023908700000-0x0000023908710000-memory.dmp
memory/1448-153-0x0000023908710000-0x0000023908720000-memory.dmp
memory/1448-152-0x0000023908660000-0x0000023908670000-memory.dmp
memory/1448-2-0x0000023908310000-0x0000023908580000-memory.dmp
memory/1448-117-0x0000023908650000-0x0000023908660000-memory.dmp
memory/1448-165-0x0000023908670000-0x0000023908680000-memory.dmp
memory/1448-85-0x0000023908630000-0x0000023908640000-memory.dmp
memory/1448-11-0x0000023906B40000-0x0000023906B41000-memory.dmp
memory/1448-27-0x00000239085E0000-0x00000239085F0000-memory.dmp
memory/1448-171-0x0000023908690000-0x00000239086A0000-memory.dmp
memory/1448-170-0x0000023908680000-0x0000023908690000-memory.dmp
memory/1448-188-0x0000023908750000-0x0000023908760000-memory.dmp
memory/1448-193-0x0000023908760000-0x0000023908770000-memory.dmp
memory/1448-192-0x00000239086A0000-0x00000239086B0000-memory.dmp
memory/1448-198-0x0000023908770000-0x0000023908780000-memory.dmp
memory/1448-197-0x00000239086B0000-0x00000239086C0000-memory.dmp
memory/1448-203-0x0000023908790000-0x00000239087A0000-memory.dmp
memory/1448-202-0x0000023908780000-0x0000023908790000-memory.dmp
memory/1448-201-0x00000239086C0000-0x00000239086D0000-memory.dmp
memory/1448-206-0x00000239087A0000-0x00000239087B0000-memory.dmp
memory/1448-205-0x00000239086D0000-0x00000239086E0000-memory.dmp
memory/1448-213-0x0000023908700000-0x0000023908710000-memory.dmp
memory/1448-212-0x00000239086F0000-0x0000023908700000-memory.dmp
memory/1448-210-0x00000239087B0000-0x00000239087C0000-memory.dmp
memory/1448-209-0x00000239086E0000-0x00000239086F0000-memory.dmp
memory/1448-214-0x00000239087C0000-0x00000239087D0000-memory.dmp
memory/1448-223-0x00000239087D0000-0x00000239087E0000-memory.dmp
memory/1448-222-0x0000023908710000-0x0000023908720000-memory.dmp
memory/1448-229-0x0000023908720000-0x0000023908730000-memory.dmp
memory/1448-230-0x00000239087E0000-0x00000239087F0000-memory.dmp
memory/1448-235-0x0000023908730000-0x0000023908740000-memory.dmp
memory/1448-236-0x0000023908740000-0x0000023908750000-memory.dmp
memory/1448-241-0x0000023908750000-0x0000023908760000-memory.dmp
memory/1448-249-0x00000239087F0000-0x0000023908800000-memory.dmp
memory/1448-248-0x0000023908760000-0x0000023908770000-memory.dmp
memory/1448-263-0x0000023908620000-0x0000023908630000-memory.dmp
memory/1448-274-0x00000239086D0000-0x00000239086E0000-memory.dmp
memory/1448-273-0x00000239086C0000-0x00000239086D0000-memory.dmp
memory/1448-272-0x00000239086B0000-0x00000239086C0000-memory.dmp
memory/1448-271-0x0000023908690000-0x00000239086A0000-memory.dmp
memory/1448-270-0x00000239086A0000-0x00000239086B0000-memory.dmp
memory/1448-269-0x0000023908680000-0x0000023908690000-memory.dmp
memory/1448-268-0x0000023908670000-0x0000023908680000-memory.dmp
memory/1448-267-0x0000023908660000-0x0000023908670000-memory.dmp
memory/1448-266-0x0000023908650000-0x0000023908660000-memory.dmp
memory/1448-265-0x0000023908640000-0x0000023908650000-memory.dmp
memory/1448-264-0x0000023908630000-0x0000023908640000-memory.dmp
memory/1448-262-0x0000023908610000-0x0000023908620000-memory.dmp
memory/1448-261-0x0000023908600000-0x0000023908610000-memory.dmp
memory/1448-260-0x00000239085F0000-0x0000023908600000-memory.dmp
memory/1448-259-0x00000239085E0000-0x00000239085F0000-memory.dmp
memory/1448-258-0x00000239085D0000-0x00000239085E0000-memory.dmp
memory/1448-257-0x00000239085C0000-0x00000239085D0000-memory.dmp
memory/1448-256-0x00000239085B0000-0x00000239085C0000-memory.dmp
memory/1448-255-0x00000239085A0000-0x00000239085B0000-memory.dmp
memory/1448-254-0x0000023908590000-0x00000239085A0000-memory.dmp
memory/1448-253-0x0000023908580000-0x0000023908590000-memory.dmp
memory/1448-252-0x0000023908310000-0x0000023908580000-memory.dmp