Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 22:36
Behavioral task
behavioral1
Sample
BazaarNotifier-1.7.2.jar.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
BazaarNotifier-1.7.2.jar.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
General
-
Target
BazaarNotifier-1.7.2.jar.exe
-
Size
17.8MB
-
MD5
dec559dbf156602f2d4594e81a700613
-
SHA1
984e68328a583c7c95538794d38f32caff4e95f3
-
SHA256
55c84564a5c2c441aff58952df4c40e5074f37243c65a694607f874e538fcd7a
-
SHA512
aaa8026082e0d6235ed5b40fdc0893337a84f2136c1008a6d5834521cef8815a56ca1105e3d7997961907fc7d32695a2a84de61dd36092c106809898a5b9f29a
-
SSDEEP
393216:MqPnLFXlrPmQ8DOETgsvfGXgKxwqtvEEX5nf/iUm:9PLFXNOQhEsdxVCOnfW
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2548 BazaarNotifier-1.7.2.jar.exe 2264 BazaarNotifier-1.7.2.jar.exe -
System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs
Adversaries may abuse Verclsid to proxy execution of malicious code.
pid Process 2560 verclsid.exe -
resource yara_rule behavioral1/files/0x000500000001a507-111.dat upx behavioral1/memory/2264-337-0x000007FEF4AB0000-0x000007FEF4F1E000-memory.dmp upx behavioral1/memory/2832-338-0x0000000140000000-0x00000001405E8000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2832 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2832 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe 2832 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2548 2276 BazaarNotifier-1.7.2.jar.exe 30 PID 2276 wrote to memory of 2548 2276 BazaarNotifier-1.7.2.jar.exe 30 PID 2276 wrote to memory of 2548 2276 BazaarNotifier-1.7.2.jar.exe 30 PID 1780 wrote to memory of 2264 1780 BazaarNotifier-1.7.2.jar.exe 35 PID 1780 wrote to memory of 2264 1780 BazaarNotifier-1.7.2.jar.exe 35 PID 1780 wrote to memory of 2264 1780 BazaarNotifier-1.7.2.jar.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"2⤵
- Loads dropped DLL
PID:2548
-
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
PID:2560
-
C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"C:\Users\Admin\AppData\Local\Temp\BazaarNotifier-1.7.2.jar.exe"2⤵
- Loads dropped DLL
PID:2264
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378