Resubmissions
18-10-2024 19:59
241018-yqwp8axejn 718-10-2024 19:55
241018-ynenxsvgjb 118-10-2024 19:55
241018-ym477axcqj 712-10-2023 23:22
231012-3cqdhaeh6t 10Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-10-2024 19:59
Static task
static1
Behavioral task
behavioral1
Sample
Installer.jar
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Installer.jar
Resource
win11-20241007-en
General
-
Target
Installer.jar
-
Size
18.4MB
-
MD5
eaf63a5d5730fcf1c8cc5cf27354e911
-
SHA1
f22c4b0a9c608ec00b6b84cabe434a240063e642
-
SHA256
f51e4d9f7907dd07ee264439433e0051c5136712cbbb0cc5a81be3b7023df585
-
SHA512
2dca09810b38664f23ca89d72f24e632d5c74874b4d9d0174dce86c30126ee1296a281da768b228840f0160ddb331e48591799799cadbf5a02d294e914a09a80
-
SSDEEP
393216:p6aRouWO9ojV8LJxXlReGOHsxoU+REFJAHYyjFRyHJpy/LAfIiMYX/rQ:PRQ+oqdxVReGksiJL4CFcH2EX/s
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4984 java.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4984 java.exe 4984 java.exe 4984 java.exe 4984 java.exe 4984 java.exe 4984 java.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Installer.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4984
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:2604
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\68cdb10b-bf49-49e8-978b-451935603caa.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
21KB
MD54ca3290a99adadde557930cd481d7539
SHA126034442a76131dd3d37c8f28b6e9bebc7c1fe7c
SHA256dd130c68dc36bcedbe51a6b8ec3b3358a460d45952f6280e12331f48850b6b3b
SHA5129341c60f92dd3f89f82555055924bdae6fcce1e4cd13a7dde5129ebdce04bae377292237a2ed6c3e7623b242e82b01c7ed1717af4d7db8ca473e9fd7b7b190d5