Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    04/06/2024, 12:41

General

  • Target

    DB46ADCFAE462E7C475C171FBE66DF82_paymentadvice.jar

  • Size

    128KB

  • MD5

    db46adcfae462e7c475c171fbe66df82

  • SHA1

    2b43211053d00147b2cb9847843911c771fd3db4

  • SHA256

    02d1e6dd2f3eecf809d8cd43b5b49aa76c6f322cf4776d7b190676c5f12d6b45

  • SHA512

    25beab216af2dd7ff9fe4db6a7a4b1246ee225ef9ab48af2873bf5076b8b22ba2c75224592e6b34bddfbb8718a754ffd7c63db6167ef1992b04db143c58e377b

  • SSDEEP

    3072:VR/6ZQvChcDfJNBOFJKMRXcCqfrCUMBpXOg84WoUeonNTFN:LdvCGJN0FJ1RXcgBpXOjOjSNTFN

Score
8/10

Malware Config

Signatures

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\DB46ADCFAE462E7C475C171FBE66DF82_paymentadvice.jar
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\system32\reg.exe
      reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v GKXeW0Yke7 /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\9bor9J6cRd\unXX0JIhwW.txt\"" /f
      2⤵
      • Adds Run key to start application
      • Modifies registry key
      PID:2956
    • C:\Windows\system32\reg.exe
      reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GKXeW0Yke7 /f
      2⤵
      • Modifies registry key
      PID:2504
    • C:\Windows\system32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\9bor9J6cRd\*.*"
      2⤵
      • Sets file to hidden
      • Drops desktop.ini file(s)
      • Views/modifies file attributes
      PID:2972
    • C:\Windows\system32\attrib.exe
      attrib +s +h +r "C:\Users\Admin\AppData\Roaming\9bor9J6cRd"
      2⤵
      • Sets file to hidden
      • Views/modifies file attributes
      PID:884
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\9bor9J6cRd\unXX0JIhwW.txt"
      2⤵
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2672
      • C:\Windows\system32\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v GKXeW0Yke7 /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\9bor9J6cRd\unXX0JIhwW.txt\"" /f
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:1244
      • C:\Windows\system32\reg.exe
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GKXeW0Yke7 /f
        3⤵
        • Modifies registry key
        PID:1360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\9bor9J6cRd\Desktop.ini

    Filesize

    63B

    MD5

    e783bdd20a976eaeaae1ff4624487420

    SHA1

    c2a44fab9df00b3e11582546b16612333c2f9286

    SHA256

    2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3

    SHA512

    8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80

  • C:\Users\Admin\AppData\Roaming\9bor9J6cRd\unXX0JIhwW.txt

    Filesize

    128KB

    MD5

    db46adcfae462e7c475c171fbe66df82

    SHA1

    2b43211053d00147b2cb9847843911c771fd3db4

    SHA256

    02d1e6dd2f3eecf809d8cd43b5b49aa76c6f322cf4776d7b190676c5f12d6b45

    SHA512

    25beab216af2dd7ff9fe4db6a7a4b1246ee225ef9ab48af2873bf5076b8b22ba2c75224592e6b34bddfbb8718a754ffd7c63db6167ef1992b04db143c58e377b

  • memory/2088-31-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-68-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-2-0x0000000002690000-0x0000000002900000-memory.dmp

    Filesize

    2.4MB

  • memory/2088-36-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-42-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-59-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-19-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-10-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2088-70-0x0000000002690000-0x0000000002900000-memory.dmp

    Filesize

    2.4MB

  • memory/2088-23-0x0000000000140000-0x0000000000141000-memory.dmp

    Filesize

    4KB

  • memory/2672-66-0x0000000002620000-0x0000000002890000-memory.dmp

    Filesize

    2.4MB

  • memory/2672-75-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2672-87-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2672-94-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2672-102-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2672-108-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/2672-144-0x0000000002620000-0x0000000002890000-memory.dmp

    Filesize

    2.4MB