Analysis
-
max time kernel
31s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 01:54
Behavioral task
behavioral1
Sample
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
Resource
win10v2004-20240802-en
Errors
General
-
Target
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
-
Size
84KB
-
MD5
ddaffd1e47777bd6ee6f1d89f80dbddb
-
SHA1
66c0dd7372365df8546b63d98f8c2c4eb0759429
-
SHA256
4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
-
SHA512
3fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060
-
SSDEEP
1536:dVu6KIkej8xhZfQk7A0eSaNa650oIDZaQx2fCRMiMUTBEbY4dTe46gX+LFSnUhru:j2r1fH7A0dT6HFfCi
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar\"" java.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2144 schtasks.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 896 wrote to memory of 1496 896 java.exe 89 PID 896 wrote to memory of 1496 896 java.exe 89 PID 896 wrote to memory of 1580 896 java.exe 91 PID 896 wrote to memory of 1580 896 java.exe 91 PID 1496 wrote to memory of 2144 1496 cmd.exe 93 PID 1496 wrote to memory of 2144 1496 cmd.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"2⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2144
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar"2⤵PID:1580
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\4005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c.jar
Filesize84KB
MD5ddaffd1e47777bd6ee6f1d89f80dbddb
SHA166c0dd7372365df8546b63d98f8c2c4eb0759429
SHA2564005216ddf9e092bddda8a78f0babe94746632ef6a64793e1fa0e94f1538a49c
SHA5123fa34856f71640e635b75c1e8365db43f60d164f7122fce6612cf1d22d9ee9ddd9e8fd493076dcc69a5348a6a5d4db345fdbb869716905cb679210b12ba00060
-
Filesize
46B
MD5061ad14152c204e319e69ec90b9492d1
SHA190fbb6eac65fff6aab551d8a892bc5eda8858171
SHA256272e8265f26a94e230467480201482f6ab2fb518eddafd2c1aecbf25e6c96299
SHA512956da8b732589da204f6d9b50a16ce0bcc59ef5bebd52e08fc85452a89a2f4c57be9eeb4bce49ec1056e7ea5b877fbf8b58ae293f473f76d1b2f55637181cc66