Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 19:35
Behavioral task
behavioral1
Sample
OFFER-INQUIRY.jar
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
OFFER-INQUIRY.jar
Resource
win10v2004-20240802-en
General
-
Target
OFFER-INQUIRY.jar
-
Size
84KB
-
MD5
ddaffd1e47777bd6ee6f1d89f80dbddb
-
SHA1
66c0dd7372365df8546b63d98f8c2c4eb0759429
-
SHA256
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
-
SHA512
3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060
-
SSDEEP
1536:dVu6KIkej8xhZfQk7A0eSaNa650oIDZaQx2fCRMiMUTBEbY4dTe46gX+LFSnUhru:j2r1fH7A0dT6HFfCi
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OFFER-INQUIRY.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OFFER-INQUIRY = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\OFFER-INQUIRY.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OFFER-INQUIRY = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\OFFER-INQUIRY.jar\"" java.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
java.execmd.exedescription pid Process procid_target PID 4496 wrote to memory of 1560 4496 java.exe 88 PID 4496 wrote to memory of 1560 4496 java.exe 88 PID 4496 wrote to memory of 392 4496 java.exe 90 PID 4496 wrote to memory of 392 4496 java.exe 90 PID 1560 wrote to memory of 1512 1560 cmd.exe 92 PID 1560 wrote to memory of 1512 1560 cmd.exe 92 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\OFFER-INQUIRY.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1512
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\OFFER-INQUIRY.jar"2⤵PID:392
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5ddaffd1e47777bd6ee6f1d89f80dbddb
SHA166c0dd7372365df8546b63d98f8c2c4eb0759429
SHA2564005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
SHA5123fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060
-
Filesize
46B
MD52dee0fadaf42a32cb1d70cd32998e5ae
SHA1439597981e8e649749ecfe2fcd100793f3d0f3e3
SHA2564268d2aaf27a5e0316808119814b8aa3b66857390d1e1b05d78bd55c93afb71d
SHA51243e87f6d318932d2ac571d1410b8488e0ee8e380317ff0c4ec718621bd2522be6a9eb2a9a688f40b33fe3dc3a897e010b5171c8ed031b79e8bf8403b83453ea3