0329e4b80be853302b4cb08a84d70b54de5cb86247e50e5cc6d4a8f568a9aa00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ls.exe
Size 3.1MB
Sample240603-mnzhjsbe8w
SHA256 0329e4b80be853302b4cb08a84d70b54de5cb86247e50e5cc6d4a8f568a9aa00
MD5 9fee5d57bbc9ad824a24680ea7e5b6ee
SHA1 79a94ee440c1dd97fb91b07d9c18d3e56c2d89a1
SHA512 4cf814c24341ff2a19be8f7a53a35440fa7dac351c676c1524eae7f76832e3ca73b2c2130df22e75e62b361feb6cd40709d957adeadcc8be673e1586cc2518cf
SSDEEP 49152:HFiLmDjg0HEUKlTuK6igRROMCTI93qkw6SPjVqr1oO7jFj8Jlne+htT+:kSDjTHEUKlTuKZgjsT63+60JqZZn58Jg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2028	javaw.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2572	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Security = "C:\\Users\\Admin\\AppData\\Roaming\\(s)AINT\\saint.jar"	REG.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1896	REG.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2028	javaw.exe
2028	javaw.exe
2028	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2028	452	ls.exe	83
PID 452 wrote to memory of 2028	452	ls.exe	83
PID 2028 wrote to memory of 2572	2028	javaw.exe	85
PID 2028 wrote to memory of 2572	2028	javaw.exe	85
PID 2028 wrote to memory of 1896	2028	javaw.exe	88
PID 2028 wrote to memory of 1896	2028	javaw.exe	88

C:\Users\Admin\AppData\Local\Temp\ls.exe
"C:\Users\Admin\AppData\Local\Temp\ls.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ls.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:2572
- - C:\Windows\SYSTEM32\REG.exe
    REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V "Security" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\(s)AINT\saint.jar"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 e4430d609b0315f77bbf217e3e3d035242533727fa6fdc5e0f20fd2bebaede94
MD5 3d96e21c70a5a5d76fd7df327a609a01
SHA1 7c75b30b79b8f6ebb75a877300e0924dd7f9f595
SHA512 185fe3b49da5455733cbc0da5ea72e7b732443696749c866668d721ee867876de20e6c72fbf44aa37db416753550633a0caf8e7712360803178e3b7def7130e3
MD5 SHA1 SHA512

Submit Download

JNativeHook_7236323743287549532.dll

Path C:\Users\Admin\AppData\Local\Temp\JNativeHook_7236323743287549532.dll
Size 57KB
SHA256 fc23a64cc52f5b19e310a8d96b1fbfec981310359bda907f5931a53360485fbc
MD5 d12501aaf90c14a87678c1199c332694
SHA1 47a09b3b92928d9076ad162d2f03f3426fe38095
SHA512 ee0cc22ba3c28fdf1cfd1721b466f8ccd0ac590ea37f7be77a8c7e8ed9aa7ee563921b2106e9ca05cd606706eaf17b4f835053104da4567b75f1f6ccb7e6ce94
SSDEEP 384:8zVCoEWHlGsdoORYPrhSiJ2YfUv5MyyyfQ5EFxGkx8NlNHZEEvZw3AmlMDP1vJwJ:2goEWFGGwhTJFcv54OqNlNVxtJobMe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2028-3-0x0000026F01410000-0x0000026F01680000-memory.dmp

Download

memory/2028-23-0x0000026F7FB20000-0x0000026F7FB21000-memory.dmp

Download

memory/2028-24-0x0000026F7FB20000-0x0000026F7FB21000-memory.dmp

Download

memory/2028-25-0x000000006FF40000-0x000000006FF50000-memory.dmp

Download

memory/2028-29-0x0000026F01410000-0x0000026F01680000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads