dc21d272f9c15d8fefa8d57e639b046c92ddb967e7b54ff2f559ebec6de1e92e

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79e9dd35aef6558461c4b93cd0c55b76_Purchase Order.jar
Size

123KB
MD5

79e9dd35aef6558461c4b93cd0c55b76
SHA1

09c6b30b7ff918d54ee6db72bf1bc41b5d6f1ca1
SHA256

53ab4883cc1e84f1f1732bb2fdb97358490b9134156eedc516d6dde6b97018ba
SHA512

61b4121768900bd8a6a5c056f02b7d0f34d6fd2124742f80b9b80e028dbd679d961cf24a1d36c460d69b90034a107fee89fb8cf30b280265c96bd4bf38e838c0
SSDEEP

1536:XDBcxrH8YRt1mYuFGTU1Mep4fKz6stVwG/JLWOOpXILt4vhwJ+/aW6Ef2u3jx0OF:zCRjKFGTMpOKzJtVRRLWO/4OW1XdJPB

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rawshark.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\capinfos.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dumpcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tshark.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mergecap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\text2pcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	regedit.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2448	attrib.exe
2704	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yBoBG0m3Gt = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\jcwDpUEpCh\\LcuSMagrlF.txt\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yBoBG0m3Gt = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\jcwDpUEpCh\\LcuSMagrlF.txt\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini	attrib.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\tem.txt	java.exe
File opened for modification	C:\Windows\tem.txt	java.exe
File created	C:\Windows\tem.txt	javaw.exe
File opened for modification	C:\Windows\tem.txt	javaw.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
308	reg.exe
2460	reg.exe
2720	reg.exe
1956	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
948	regedit.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1284	java.exe
2428	javaw.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 2460	1284	java.exe	29
PID 1284 wrote to memory of 2460	1284	java.exe	29
PID 1284 wrote to memory of 2460	1284	java.exe	29
PID 1284 wrote to memory of 2720	1284	java.exe	30
PID 1284 wrote to memory of 2720	1284	java.exe	30
PID 1284 wrote to memory of 2720	1284	java.exe	30
PID 1284 wrote to memory of 2448	1284	java.exe	31
PID 1284 wrote to memory of 2448	1284	java.exe	31
PID 1284 wrote to memory of 2448	1284	java.exe	31
PID 1284 wrote to memory of 2704	1284	java.exe	32
PID 1284 wrote to memory of 2704	1284	java.exe	32
PID 1284 wrote to memory of 2704	1284	java.exe	32
PID 1284 wrote to memory of 2428	1284	java.exe	33
PID 1284 wrote to memory of 2428	1284	java.exe	33
PID 1284 wrote to memory of 2428	1284	java.exe	33
PID 2428 wrote to memory of 1956	2428	javaw.exe	34
PID 2428 wrote to memory of 1956	2428	javaw.exe	34
PID 2428 wrote to memory of 1956	2428	javaw.exe	34
PID 2428 wrote to memory of 308	2428	javaw.exe	35
PID 2428 wrote to memory of 308	2428	javaw.exe	35
PID 2428 wrote to memory of 308	2428	javaw.exe	35
PID 2428 wrote to memory of 2012	2428	javaw.exe	38
PID 2428 wrote to memory of 2012	2428	javaw.exe	38
PID 2428 wrote to memory of 2012	2428	javaw.exe	38
PID 2012 wrote to memory of 948	2012	cmd.exe	40
PID 2012 wrote to memory of 948	2012	cmd.exe	40
PID 2012 wrote to memory of 948	2012	cmd.exe	40

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2448	attrib.exe
2704	attrib.exe

C:\Windows\system32\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\79e9dd35aef6558461c4b93cd0c55b76_Purchase Order.jar"
1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2460
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /f
  2⤵
  - Modifies registry key
  PID:2720
- C:\Windows\system32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:2448
- C:\Windows\system32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2704
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1956
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yBoBG0m3Gt /f
    3⤵
    - Modifies registry key
    PID:308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor6833894222378638656.reg
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor6833894222378638656.reg
      4⤵
      UAC bypass
      Sets file execution options in registry
      Runs .reg file with regedit
      PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TaskNetworkGathor6833894222378638656.reg

Filesize
2KB

MD5
6486acf0ca96ecdc981398855255b699

SHA1
66ec7eb84247848d0d80beec8790cd6788704cd3

SHA256
f96b76b3db9739c7d7e0fcac48c19191895abb5b5d18eca35cfbb9c695fbfcfc

SHA512
6677dff216eab25383539040b5d48e9fd9c6025e6276b973bd462349451616ad6bc59d07e7c760f40c326446cd5eb19417c14cb0e35f169cd702d2be1202c8fd

Download Submit
C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\Desktop.ini

Filesize
63B

MD5
e783bdd20a976eaeaae1ff4624487420

SHA1
c2a44fab9df00b3e11582546b16612333c2f9286

SHA256
2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

SHA512
8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

Download Submit
C:\Users\Admin\AppData\Roaming\jcwDpUEpCh\LcuSMagrlF.txt

Filesize
123KB

MD5
79e9dd35aef6558461c4b93cd0c55b76

SHA1
09c6b30b7ff918d54ee6db72bf1bc41b5d6f1ca1

SHA256
53ab4883cc1e84f1f1732bb2fdb97358490b9134156eedc516d6dde6b97018ba

SHA512
61b4121768900bd8a6a5c056f02b7d0f34d6fd2124742f80b9b80e028dbd679d961cf24a1d36c460d69b90034a107fee89fb8cf30b280265c96bd4bf38e838c0

Download Submit
memory/1284-37-0x0000000002020000-0x0000000002290000-memory.dmp

Filesize
2.4MB

Download
memory/1284-2-0x0000000002020000-0x0000000002290000-memory.dmp

Filesize
2.4MB

Download
memory/1284-19-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/1284-36-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/1284-26-0x0000000001CD0000-0x0000000001CD1000-memory.dmp

Filesize
4KB

Download
memory/2428-61-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2428-53-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2428-62-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2428-64-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2428-35-0x0000000002290000-0x0000000002500000-memory.dmp

Filesize
2.4MB

Download
memory/2428-100-0x0000000002290000-0x0000000002500000-memory.dmp

Filesize
2.4MB

Download
memory/2428-110-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2428-128-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads