3a00c5b808954e9dca76418506eacec9cb1cb0fd844318a896ebae787f5eaae2

Resubmissions

25/07/2024, 16:34

240725-t3bhla1gjk

25/07/2024, 16:20

240725-ts67hstfme7

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jarfix.exe
Size 71KB
Sample240725-ts67hstfme
SHA256 3a00c5b808954e9dca76418506eacec9cb1cb0fd844318a896ebae787f5eaae2
MD5 dd9f1cadb75365e4646a814e8d022010
SHA1 a963f573f3fe0422b867dabad52bd7d345ff4d49
SHA512 b78415dd79a4579b97cc476c8fba9d886095c9a65967914c82b1aa6a3c3ad6dc51701692d3bea55284997124bd89dab4581b68276fe44104a089a0352b6cc986
SSDEEP 1536:EKJAES3bS2L6KbuVfmMk0DCwcOmwzYPdCHQw8TKw72lBN6dimW:3J2S2L6KbqDCwcOuPUSWu2lBN6fW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3812	jarfix.exe
3812	jarfix.exe
3812	jarfix.exe
3812	jarfix.exe
3812	jarfix.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jarfix.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile	jarfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\ = "Executable Jar File"	jarfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile	jarfix.exe
Key created	\REGISTRY\MACHINE\Software\Classes\jarfile\shell\open\command	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command\ = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"%1\" %*"	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.JAR	jarfix.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "jarfile"	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell	jarfix.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open\command	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JARFILE\SHELL\OPEN\COMMAND	jarfix.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\jarfile\shell\open	jarfix.exe

C:\Users\Admin\AppData\Local\Temp\jarfix.exe
"C:\Users\Admin\AppData\Local\Temp\jarfix.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshCC2A.tmp\System.dll
Size 10KB
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nshCC2A.tmp\UserInfo.dll
Size 4KB
SHA256 6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3
MD5 e840e7f30c85e22b09a41098ff3f3343
SHA1 ad1eb7b2ba66ae87641947025736c67efbc4b9d8
SHA512 ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b
MD5 SHA1 SHA512