c28091facc92091cf730431a4477ae321f3c6da10a6109ab1d528889a5e01ca0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c28091facc92091cf730431a4477ae321f3c6da10a6109ab1d528889a5e01ca0.jar
Size 121KB
Sample240612-cmjetsydre
SHA256 c28091facc92091cf730431a4477ae321f3c6da10a6109ab1d528889a5e01ca0
MD5 6e061d52b31bf85f9b57249e092e3d77
SHA1 de2102b57db2f59c46c8faedc2dd4162ac91e80a
SHA512 e5de739dda20a718478f0e51a3988848b6eb6e55a14b026ce56762e440b47dbf8454af073319e359369c2c1b3a13e44ce5664b281c37f1c8789f09c6427b356c
SSDEEP 3072:Gr7icT37QUMcrDKQ+3mDCvQrORzxoYqsvabHPZ+qt:KbD7QfSV4QORiYqsvabBXt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	wscript.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4908	icacls.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4908	4900	java.exe	83
PID 4900 wrote to memory of 4908	4900	java.exe	83
PID 4900 wrote to memory of 4732	4900	java.exe	85
PID 4900 wrote to memory of 4732	4900	java.exe	85
PID 4732 wrote to memory of 1140	4732	wscript.exe	88
PID 4732 wrote to memory of 1140	4732	wscript.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\c28091facc92091cf730431a4477ae321f3c6da10a6109ab1d528889a5e01ca0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4908
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\cnnjcxsvhq.js
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\fhqjcklkwd.txt"
    3⤵
    PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 896a00c111e5af9aed59f2e82fcb40ed336fc0109a5ccd49f6a36e6016d0b920
MD5 de51706d4aa10aa2a8394c14def7cf0e
SHA1 e42ddc396e544a9a8b9dfab40d66a07a20ab8e8b
SHA512 18f79476d5707fa250e884670b710b4a4984d98d5c81144eaf2fcde4058b36e25d404d1072a71de55999cca260708794b900f4160e08bcff54b1f21ebce20828
MD5 SHA1 SHA512

Submit Download

fhqjcklkwd.txt

Path C:\Users\Admin\AppData\Roaming\fhqjcklkwd.txt
Size 92KB
SHA256 943a982c65ebf476f6f454a95e4f8105f6c89d3e90d638113f718a208aa51db0
MD5 40324e4190ca694d65c17b8142490c1e
SHA1 14f8a7fbd6580cc1146a04af95c37b6772bb5215
SHA512 885107f66e0441f1d14ae4f193bcacea831f46872ec74501d82f29af7e51731714acf8a63fce72dac557c20c6cd15d1e77734e3fa443bc28dd3cda5aca22f5b7
SSDEEP 1536:fY/91A3oP139Q/1+jcuc7/nGSwPs2WN0kpLMmjHTzZbheB3gHGv4vxNpEHrGGH:fY43oP1tQgjkG5PzWak9MmTT+B3JvJL1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cnnjcxsvhq.js

Path C:\Users\Admin\cnnjcxsvhq.js
Size 198KB
SHA256 edb1c2359843e87bceed68c4919e6282f92ce757ab67a7ba2f25978017d5b5c7
MD5 0f14d20395d2bdb0528def8777b7d0f0
SHA1 c6dcb002a5ec3470e1779908bcd666b2ae53c3c8
SHA512 92d806e8eb3d9a23f64f8eda62759c57f98cff7615d0f32226710a19364e827d8c2e75e80f908e343818ec808cdf5c1aaf2998b8555b82bceddcf448494b2700
SSDEEP 3072:DQIDvnJGk2FpOMzz4qqgrhSJCTcdt+RqfIjXu/ueszYdaxME4jHLKKwgFZZhat7:DQeMXzEqTIJLzREXump3xMvqKPFZ07
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1140-21-0x00000199527D0000-0x0000019952A40000-memory.dmp

Download

memory/1140-47-0x00000199527B0000-0x00000199527B1000-memory.dmp

Download

memory/1140-61-0x00000199527D0000-0x0000019952A40000-memory.dmp

Download

memory/4900-2-0x0000021FEBEC0000-0x0000021FEC130000-memory.dmp

Download

memory/4900-14-0x0000021FEBEA0000-0x0000021FEBEA1000-memory.dmp

Download

memory/4900-16-0x0000021FEBEC0000-0x0000021FEC130000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads