Analysis
-
max time kernel
50s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 02:49
General
-
Target
1.jar
-
Size
1.1MB
-
MD5
a5483a74a3cbf726d2ebf659247ec9c7
-
SHA1
a9b28e22845934adff30ad44b293d714230344ea
-
SHA256
37c49983dfd813e67d898b4088ea29e2146674aeba37059944db194a004dc2af
-
SHA512
a651326628acade8adebeeec9c974d087f22cb8d868c98432c8f967ab4180c6beb7186c7b0b31e6428240017f360270d6ce90f31953c8fafe5dc4e5e0ecc9ad7
-
SSDEEP
24576:dzhTX3kLlzYc4lMTboiqSr9xZXfRCUOutEUKIzWG:dzSLlUpSbYIn/Cl8zWG
Malware Config
Signatures
-
Ratty
Ratty is an open source Java Remote Access Tool.
-
Ratty Rat payload 1 IoCs
-
Drops startup file 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies registry class 4 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\1.jar1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\REG.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "1.jar" /d "C:\Users\Admin\AppData\Roaming\1.jar" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\1.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.jar2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD555f4de7f270663b3dc712b8c9eed422a
SHA17432773eb4d09dc286d43fcc77ddb0e1e3bce2b4
SHA25647c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25
SHA5129da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996
-
Filesize
5KB
MD5759d757c7f5e7baf0a0afbbe2b665fa9
SHA1bece81b8109595313e1a8f7c0fa0435fbd54a56c
SHA25631df6ab770623bf7b2e7f9f17a64718bb8a66142f14349c9d988a9d3de20df13
SHA512938a3f3f754c0a05eee6b70bc6d3adf6eb52a4591c17b984b0019fd842c45773a1c12e90909bf4d3bf2a4dff9e8baf3f8fa3129bd8c030fd10bda5d3afd8933b
-
Filesize
5KB
MD54d574d102c935c80eaffe68db43b05d7
SHA1b43f44e10b8302bac1bdd90a2c6b8b0a84b8f4e5
SHA2566ad76f7d99ac561d0707dc6746ddec5a584e1c1193fd62ecefa5c413a92bda27
SHA51266540d8501b1253068720a03aeb384f2a928ad26617db2c82d607596d3eebf9e236291ac0e351308dc8f61fed2a898da75a0992a17240dce664d1441796d4434
-
Filesize
4KB
MD54cd9285d3ec27eef3794257652b8870a
SHA1dc5fe005391167db7950072ae782314f2424a18c
SHA2567a93d1077a8a37a534f4ea903cefec2c1b7dd545bd8b4f2ba2030376ff1d4b10
SHA512364d3dff0e4bef220099a3682878d83093301c548ea5cdf25908ebfd20727a26b147c85b85dc02f29d8c483683335dcd761556fcaee00acc878a9eb76a2b732b
-
Filesize
1KB
MD52e03e5601739082aa7405d598955dd4c
SHA104b4a15c7aa19ce755b6acaefffcf12b34017070
SHA2565430976fd16f0d0fb6b4657f5b85651661e8c353d00d9be36c90ac095818ea80
SHA5124c33dd97ec5c5b5b11309a988cd8ee79f3c02d04e7609ad0405dff9ce166c803c05c3e343ccaca1c90ad3172c26238e00a542874574b92e7222e37880e44ff14
-
Filesize
4KB
MD5bb3bfaadfbf190411704d1cc4c5af9a8
SHA142dc2828071d6a21022185ca854db6bc720d73b5
SHA25647e63490a3de67dba355be6b8e270997d064a1cf55e2270f719ff6cd837715dd
SHA512db816e3aba0eeaa9b48a7c8eb79423c887bb59b55e7110e4cabfe0c28e6c5b806d141b789bfad1bbf278eac636ac483f52f8e9ca9c9bbdfa6858e58c3de076ba
-
Filesize
3KB
MD516ad7853ba57d1085c45ba66677ff88f
SHA10025152eb099de7ef3ab1bf34e62dad25d68b71f
SHA2569521a5f7a24dabd1b1bf5a15b68c66445c2c9a6ace6c7dcef96b5b3fb17384c4
SHA512b89f6c1052dad467103ad010641f0c25f20497d034d97c5cc75a389f291414b0e8a02d4cc491e4bbe8eb96ac085af679477c115660f9fbe5dc85de0c008a3486
-
Filesize
5KB
MD51b1213c464ba658fea9193452b35c7ea
SHA1dc9e46786387d6a32b52586245dc3709eb52b93f
SHA256d3106e34fc4c0df4c950fc3821bd97d52d73adcf46d91b849ef78345eabdbc84
SHA51244f44ee50e90d3ea4fa56873c45e99234b04020089a49c4a8cf8599fed108bf6c17f4b8bcff100f99b1212b78f6d46a6ced80c434b27bc1f36df0634a1bf779d
-
Filesize
6KB
MD5ef446412f3cea66f9d95ea39ec32ff89
SHA1fe75d661dded7258bb57db846877ee30c45616d3
SHA25668faab6f1b37316cf748cb69f663e1254885ba28a02b5303aebdf9030a380d73
SHA5126e112b7bdd30efa2d04dbcc9667e0ac30da63196cd483b7949194ab2a79faf283e1a1bb19bb1b3793ec793c06b00881a1b0b5e492290b52220da39767d3683a8
-
Filesize
6KB
MD55dad0d86c00519f127c9a288e14593ff
SHA19b9731bb3c95eb29de46eb8cf60ff4133999d2b8
SHA25690cbf6e2067fd17833b71db0ac80566298f19aa85e31a56d33a2e2c4d5a20990
SHA51273a0fb806cf8d8c56768e7a819b7a8057628f38e93e6eb9e0949f1c748d0968054e792622af4731f91bd3798b2361c5fe4cb3d3c84720e52183382dba7ad33f7
-
Filesize
1.1MB
MD5a5483a74a3cbf726d2ebf659247ec9c7
SHA1a9b28e22845934adff30ad44b293d714230344ea
SHA25637c49983dfd813e67d898b4088ea29e2146674aeba37059944db194a004dc2af
SHA512a651326628acade8adebeeec9c974d087f22cb8d868c98432c8f967ab4180c6beb7186c7b0b31e6428240017f360270d6ce90f31953c8fafe5dc4e5e0ecc9ad7
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
84KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB