Analysis

  • max time kernel
    31s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 01:54

Errors

Reason
Machine shutdown

General

  • Target

    4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar

  • Size

    84KB

  • MD5

    ddaffd1e47777bd6ee6f1d89f80dbddb

  • SHA1

    66c0dd7372365df8546b63d98f8c2c4eb0759429

  • SHA256

    4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c

  • SHA512

    3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060

  • SSDEEP

    1536:dVu6KIkej8xhZfQk7A0eSaNa650oIDZaQx2fCRMiMUTBEbY4dTe46gX+LFSnUhru:j2r1fH7A0dT6HFfCi

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2144
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"
      2⤵
        PID:1580

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar

      Filesize

      84KB

      MD5

      ddaffd1e47777bd6ee6f1d89f80dbddb

      SHA1

      66c0dd7372365df8546b63d98f8c2c4eb0759429

      SHA256

      4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c

      SHA512

      3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      061ad14152c204e319e69ec90b9492d1

      SHA1

      90fbb6eac65fff6aab551d8a892bc5eda8858171

      SHA256

      272e8265f26a94e230467480201482f6ab2fb518eddafd2c1aecbf25e6c96299

      SHA512

      956da8b732589da204f6d9b50a16ce0bcc59ef5bebd52e08fc85452a89a2f4c57be9eeb4bce49ec1056e7ea5b877fbf8b58ae293f473f76d1b2f55637181cc66

    • memory/896-32-0x000002A3802E0000-0x000002A3802F0000-memory.dmp

      Filesize

      64KB

    • memory/896-35-0x000002A380000000-0x000002A380270000-memory.dmp

      Filesize

      2.4MB

    • memory/896-20-0x000002A3802B0000-0x000002A3802C0000-memory.dmp

      Filesize

      64KB

    • memory/896-19-0x000002A3802A0000-0x000002A3802B0000-memory.dmp

      Filesize

      64KB

    • memory/896-23-0x000002A3802C0000-0x000002A3802D0000-memory.dmp

      Filesize

      64KB

    • memory/896-24-0x000002A3802D0000-0x000002A3802E0000-memory.dmp

      Filesize

      64KB

    • memory/896-14-0x000002A380280000-0x000002A380290000-memory.dmp

      Filesize

      64KB

    • memory/896-31-0x000002A3F9E10000-0x000002A3F9E11000-memory.dmp

      Filesize

      4KB

    • memory/896-12-0x000002A380270000-0x000002A380280000-memory.dmp

      Filesize

      64KB

    • memory/896-16-0x000002A380290000-0x000002A3802A0000-memory.dmp

      Filesize

      64KB

    • memory/896-43-0x000002A3802E0000-0x000002A3802F0000-memory.dmp

      Filesize

      64KB

    • memory/896-42-0x000002A3802D0000-0x000002A3802E0000-memory.dmp

      Filesize

      64KB

    • memory/896-41-0x000002A3802C0000-0x000002A3802D0000-memory.dmp

      Filesize

      64KB

    • memory/896-40-0x000002A3802B0000-0x000002A3802C0000-memory.dmp

      Filesize

      64KB

    • memory/896-39-0x000002A3802A0000-0x000002A3802B0000-memory.dmp

      Filesize

      64KB

    • memory/896-38-0x000002A380290000-0x000002A3802A0000-memory.dmp

      Filesize

      64KB

    • memory/896-37-0x000002A380280000-0x000002A380290000-memory.dmp

      Filesize

      64KB

    • memory/896-36-0x000002A380270000-0x000002A380280000-memory.dmp

      Filesize

      64KB

    • memory/896-2-0x000002A380000000-0x000002A380270000-memory.dmp

      Filesize

      2.4MB

    • memory/1580-47-0x0000019980000000-0x0000019980270000-memory.dmp

      Filesize

      2.4MB

    • memory/1580-60-0x0000019980280000-0x0000019980290000-memory.dmp

      Filesize

      64KB

    • memory/1580-59-0x0000019980270000-0x0000019980280000-memory.dmp

      Filesize

      64KB

    • memory/1580-62-0x0000019980290000-0x00000199802A0000-memory.dmp

      Filesize

      64KB

    • memory/1580-66-0x00000199802B0000-0x00000199802C0000-memory.dmp

      Filesize

      64KB

    • memory/1580-65-0x00000199802A0000-0x00000199802B0000-memory.dmp

      Filesize

      64KB

    • memory/1580-68-0x00000199802C0000-0x00000199802D0000-memory.dmp

      Filesize

      64KB

    • memory/1580-72-0x00000199802E0000-0x00000199802F0000-memory.dmp

      Filesize

      64KB

    • memory/1580-71-0x00000199802D0000-0x00000199802E0000-memory.dmp

      Filesize

      64KB

    • memory/1580-74-0x00000199F9500000-0x00000199F9501000-memory.dmp

      Filesize

      4KB

    • memory/1580-76-0x0000019980000000-0x0000019980270000-memory.dmp

      Filesize

      2.4MB

    • memory/1580-77-0x0000019980270000-0x0000019980280000-memory.dmp

      Filesize

      64KB

    • memory/1580-78-0x0000019980280000-0x0000019980290000-memory.dmp

      Filesize

      64KB

    • memory/1580-80-0x0000019980290000-0x00000199802A0000-memory.dmp

      Filesize

      64KB

    • memory/1580-81-0x00000199802A0000-0x00000199802B0000-memory.dmp

      Filesize

      64KB

    • memory/1580-82-0x00000199802B0000-0x00000199802C0000-memory.dmp

      Filesize

      64KB

    • memory/1580-83-0x00000199802C0000-0x00000199802D0000-memory.dmp

      Filesize

      64KB

    • memory/1580-84-0x00000199802D0000-0x00000199802E0000-memory.dmp

      Filesize

      64KB

    • memory/1580-85-0x00000199802E0000-0x00000199802F0000-memory.dmp

      Filesize

      64KB