Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-08-2024 19:35

General

  • Target

    OFFER-INQUIRY.jar

  • Size

    84KB

  • MD5

    ddaffd1e47777bd6ee6f1d89f80dbddb

  • SHA1

    66c0dd7372365df8546b63d98f8c2c4eb0759429

  • SHA256

    4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c

  • SHA512

    3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060

  • SSDEEP

    1536:dVu6KIkej8xhZfQk7A0eSaNa650oIDZaQx2fCRMiMUTBEbY4dTe46gX+LFSnUhru:j2r1fH7A0dT6HFfCi

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\OFFER-INQUIRY.jar
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1560
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1512
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"
      2⤵
        PID:392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OFFER-INQUIRY.jar

      Filesize

      84KB

      MD5

      ddaffd1e47777bd6ee6f1d89f80dbddb

      SHA1

      66c0dd7372365df8546b63d98f8c2c4eb0759429

      SHA256

      4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c

      SHA512

      3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      2dee0fadaf42a32cb1d70cd32998e5ae

      SHA1

      439597981e8e649749ecfe2fcd100793f3d0f3e3

      SHA256

      4268d2aaf27a5e0316808119814b8aa3b66857390d1e1b05d78bd55c93afb71d

      SHA512

      43e87f6d318932d2ac571d1410b8488e0ee8e380317ff0c4ec718621bd2522be6a9eb2a9a688f40b33fe3dc3a897e010b5171c8ed031b79e8bf8403b83453ea3

    • memory/392-62-0x0000029A9F9B0000-0x0000029A9F9C0000-memory.dmp

      Filesize

      64KB

    • memory/392-46-0x0000029A9F720000-0x0000029A9F990000-memory.dmp

      Filesize

      2.4MB

    • memory/392-82-0x0000029A9FA10000-0x0000029A9FA20000-memory.dmp

      Filesize

      64KB

    • memory/392-81-0x0000029A9FA10000-0x0000029A9FA20000-memory.dmp

      Filesize

      64KB

    • memory/392-79-0x0000029A9F9D0000-0x0000029A9F9E0000-memory.dmp

      Filesize

      64KB

    • memory/392-80-0x0000029A9F9E0000-0x0000029A9F9F0000-memory.dmp

      Filesize

      64KB

    • memory/392-78-0x0000029A9F9C0000-0x0000029A9F9D0000-memory.dmp

      Filesize

      64KB

    • memory/392-77-0x0000029A9F9B0000-0x0000029A9F9C0000-memory.dmp

      Filesize

      64KB

    • memory/392-76-0x0000029A9F9A0000-0x0000029A9F9B0000-memory.dmp

      Filesize

      64KB

    • memory/392-75-0x0000029A9F990000-0x0000029A9F9A0000-memory.dmp

      Filesize

      64KB

    • memory/392-74-0x0000029A9F720000-0x0000029A9F990000-memory.dmp

      Filesize

      2.4MB

    • memory/392-71-0x0000029A9F700000-0x0000029A9F701000-memory.dmp

      Filesize

      4KB

    • memory/392-67-0x0000029A9F9D0000-0x0000029A9F9E0000-memory.dmp

      Filesize

      64KB

    • memory/392-68-0x0000029A9F9E0000-0x0000029A9F9F0000-memory.dmp

      Filesize

      64KB

    • memory/392-63-0x0000029A9F9C0000-0x0000029A9F9D0000-memory.dmp

      Filesize

      64KB

    • memory/392-60-0x0000029A9F9A0000-0x0000029A9F9B0000-memory.dmp

      Filesize

      64KB

    • memory/392-57-0x0000029A9F990000-0x0000029A9F9A0000-memory.dmp

      Filesize

      64KB

    • memory/4496-22-0x0000025C002C0000-0x0000025C002D0000-memory.dmp

      Filesize

      64KB

    • memory/4496-41-0x0000025C002D0000-0x0000025C002E0000-memory.dmp

      Filesize

      64KB

    • memory/4496-12-0x0000025C00270000-0x0000025C00280000-memory.dmp

      Filesize

      64KB

    • memory/4496-18-0x0000025C002A0000-0x0000025C002B0000-memory.dmp

      Filesize

      64KB

    • memory/4496-37-0x0000025C00290000-0x0000025C002A0000-memory.dmp

      Filesize

      64KB

    • memory/4496-38-0x0000025C002A0000-0x0000025C002B0000-memory.dmp

      Filesize

      64KB

    • memory/4496-39-0x0000025C002B0000-0x0000025C002C0000-memory.dmp

      Filesize

      64KB

    • memory/4496-40-0x0000025C002C0000-0x0000025C002D0000-memory.dmp

      Filesize

      64KB

    • memory/4496-2-0x0000025C00000000-0x0000025C00270000-memory.dmp

      Filesize

      2.4MB

    • memory/4496-17-0x0000025C00290000-0x0000025C002A0000-memory.dmp

      Filesize

      64KB

    • memory/4496-42-0x0000025C002E0000-0x0000025C002F0000-memory.dmp

      Filesize

      64KB

    • memory/4496-34-0x0000025C00000000-0x0000025C00270000-memory.dmp

      Filesize

      2.4MB

    • memory/4496-32-0x0000025C75F00000-0x0000025C75F01000-memory.dmp

      Filesize

      4KB

    • memory/4496-14-0x0000025C00280000-0x0000025C00290000-memory.dmp

      Filesize

      64KB

    • memory/4496-26-0x0000025C002E0000-0x0000025C002F0000-memory.dmp

      Filesize

      64KB

    • memory/4496-24-0x0000025C002D0000-0x0000025C002E0000-memory.dmp

      Filesize

      64KB

    • memory/4496-21-0x0000025C002B0000-0x0000025C002C0000-memory.dmp

      Filesize

      64KB

    • memory/4496-35-0x0000025C00270000-0x0000025C00280000-memory.dmp

      Filesize

      64KB

    • memory/4496-36-0x0000025C00280000-0x0000025C00290000-memory.dmp

      Filesize

      64KB