Analysis
-
max time kernel
123s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
10-08-2024 17:49
General
-
Target
087a3b87252a021f6f3696f496d4fd890f28fc31735d8f850aa1184ed7bf59c9.jar
-
Size
275KB
-
MD5
37d9c9c214040d54e8d7219b851ca3f2
-
SHA1
ea8f7ea6f0e3dd53d06c8fc4b7a956ec0642051f
-
SHA256
087a3b87252a021f6f3696f496d4fd890f28fc31735d8f850aa1184ed7bf59c9
-
SHA512
668b42f6f187232bdccf65714904d5e0e64ac792d7264262dc50fe4d5e42149b3b433a5020c0c2460c8ee4e4df4b33122545319c352ceee1577be09cf3b4530e
-
SSDEEP
384:jx+mssvoys0HC4bKgOA1lZJXk0oHA/lpk7TcADrKL1VR3Im:jjs+aoCPbA1rJXuH+2EADrcd3
Malware Config
Signatures
-
Drops startup file 2 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\087a3b87252a021f6f3696f496d4fd890f28fc31735d8f850aa1184ed7bf59c9.jar1⤵
- Drops startup file
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\087a3b87252a021f6f3696f496d4fd890f28fc31735d8f850aa1184ed7bf59c9.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Roaming\Microsoft\res.jar2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD55110c466ad9db869e9c3fc058f67326d
SHA17d7fd7e97b9a92b8c188b2a1d2e454cdabd293fd
SHA25646b072c3d27bb1d9f4e94530996bba84c7391642f44791bf6ff503e3a0949c9e
SHA5128546f70bd203025e6bc5588ef66c9c112e5513da25bf0ebecb8d55556ca0f36e3904ceb711e66dcd9b7e00dbbd8b1eb871452adc0240efe38667bf6fc94bf6b6
-
Filesize
810B
MD5acc02978471f658a75a3f6a4fd9353b0
SHA131eb221afcd84963f70c98f23a6d292a225d9b8d
SHA2567690ec61aba7496ddda1aa248510d99dee886ead9479ff1d1e1b93c682d7922a
SHA5129efa955528a869d66f8a8e408340606456d7da7a5578a92e37195d709b5829d307d98cb1488bacd786f94cb5a9dcc8cf63fcae2140599da0f4fdabd4204a30b7
-
Filesize
525KB
MD5cdb982565c7abd0cd6840eb53d7090de
SHA1a986486e425f78576083820baed5567ff68992f5
SHA2567c85bc4dfad7e620ca79fe79804e83fec0233f2432639cd02ccb3dbe1f8cef72
SHA51226f641a18683820ccd8771d6bff0f03bfc15bbf21c2ea18ee450d28d2461a4fd5b5bd81b985c0129160d568d316a040831d886a6cc2f29901526b74afc54cddf
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB