Resubmissions

03/11/2024, 04:16

241103-evtlwatqft 7

03/11/2024, 04:14

241103-etnz1axngn 6

Analysis

  • max time kernel
    873s
  • max time network
    967s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/11/2024, 04:16

General

  • Target

    LK Rat.jar

  • Size

    1.4MB

  • MD5

    8c65d5456bcd4e07d64e87b856ffb2b2

  • SHA1

    81ec28c78875d17f08603b427b7783c0cc55bb80

  • SHA256

    74148c3575a944b44668549c4a25c9a02a822b464c70c20d91cef1866fd54e9c

  • SHA512

    6b3a424eb3f83308400007020bd81d71b60b7c6b15cdf5a1e45d53ab7cc343eb66de5077492686f582025c790a496804b8e6a36d49574ed9292fb3be0cf1178e

  • SSDEEP

    24576:M0enMGto+9l1JFpABv5gUIch/lqi++f89WTuh+fl1RFxAtHT5SlJtf:3eMGbxJYvKA9QYT/zRAsd

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\LK Rat.jar"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -jar C:\Users\Admin\AppData\Local\Temp\pULHfy60799363049740799.tmp
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Windows\SYSTEM32\attrib.exe
        attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607381239.tmp
        3⤵
        • Views/modifies file attributes
        PID:2540
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607381239.tmp" /f"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Windows\system32\reg.exe
          REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607381239.tmp" /f
          4⤵
          • Adds Run key to start application
          PID:1544
    • C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607380598.tmp
      2⤵
      • Views/modifies file attributes
      PID:3668
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607380598.tmp" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\system32\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607380598.tmp" /f
        3⤵
        • Adds Run key to start application
        PID:1028
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\RepairRedo.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2068
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1676

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

              Filesize

              46B

              MD5

              d475ad3f3e32d0c0ac429ccbe2a70582

              SHA1

              b3124dbb48c42d35b94712614963f93514d40cbb

              SHA256

              c1d34fe5ced03ab025ce20043f030149c522d73496791660f5df7110550575ba

              SHA512

              a0a2760ab868e7b4efc118bea1a6def4d3e878687789f61ea0e8bea9a60e0e163b9e4ca19b8595927aeab77aa03c9c87125216ca30a0ea6e438ee4eba1edb766

            • C:\Users\Admin\.plugins\.libraries\jna70

              Filesize

              3.1MB

              MD5

              b22ef746fd14c702e5bd29b466c6312b

              SHA1

              19674f9167c56c0bbdaa3a4a48277b802e480000

              SHA256

              121f7a1d3aa9f538fd4710fd3a2175a7f062e1260d3e2df83752512a28f290d6

              SHA512

              0b1757fb6d17077b1046c73909623ddb180c6a02b872bcbb9aef40fceb9ed6ff268438e7cb62b9c5ce4c2fd944ea99cf4aa9d2d4b31d70806f1ba607fdb05b6e

            • C:\Users\Admin\AppData\Local\Temp\imageio3081979267321781896.tmp

              Filesize

              73KB

              MD5

              50affb41a526e6d58b24afc6664a8f33

              SHA1

              6d4c60a5965dd9f0df868c3def14625c56eb4a73

              SHA256

              f8307cf2f5bb19216e089bc23371f414ed3a299569e0c92e5daf1b3d76197e0a

              SHA512

              653bd409b83a845a5384e05fe2be659660b52f6b2bb95ba004d08af581833278367f70c0a01e45c18881cc8c70b9ff29f8f7d08086a3cdf49f1bb3c33dbaa32a

            • C:\Users\Admin\AppData\Local\Temp\imageio8051290321402650827.tmp

              Filesize

              26KB

              MD5

              7ae9e5ab7be7e000e3130959b10fd41f

              SHA1

              75ea22029f4e7b34cf7cb11846ccbcf952343c11

              SHA256

              15b62421835d8f439eb11095d522544a43de58f157e868c25eca080f96b0e951

              SHA512

              c7a3a3cb9bfa72319ece066b9ab3d0fa7606d61ae8919d5aa389593382f25960b64bd57e5002663b538a2a20a34a4da24f006a6d84224187e487a0c5c651764b

            • C:\Users\Admin\AppData\Local\Temp\imageio8114762163680020574.tmp

              Filesize

              73KB

              MD5

              814f5bbbce5210fc68661e8887ea8844

              SHA1

              69272975cc1b86b6bd2190de7df5a8cde859578a

              SHA256

              72f8fdc0bbf00859b5cc9a0e585fd56c98012229adc83b7c242acaba89600e84

              SHA512

              37c47173c0373c72d58f35b38d75688be4b7ecaa2792bb827cb724da87528c3abbdcf645c9d8418afac9ac4ac44fd3df329d26c1a1c7bc63e93e733c1af5dcb6

            • C:\Users\Admin\AppData\Local\Temp\pULHfy60799363049740799.tmp

              Filesize

              710KB

              MD5

              ea32d3a9a0a4c7dd26bc75b770b8d6e6

              SHA1

              79dd917e26e45af4e20a19592bbaa88c44629a76

              SHA256

              68de0bf850720a72c68ea6cec582131b176222cfc90856b744c35bde551f57d3

              SHA512

              6602ab5c0f36611e5ffec8f4f077d72f7b9858fec7104b0ad8ad0bf4b5c3ebf1d0fbf9ed53720c4dd0a6d288b3b1b050c2e9cc34f54361d811f49b19980a7a47

            • C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1730607380598.tmp

              Filesize

              1.4MB

              MD5

              8c65d5456bcd4e07d64e87b856ffb2b2

              SHA1

              81ec28c78875d17f08603b427b7783c0cc55bb80

              SHA256

              74148c3575a944b44668549c4a25c9a02a822b464c70c20d91cef1866fd54e9c

              SHA512

              6b3a424eb3f83308400007020bd81d71b60b7c6b15cdf5a1e45d53ab7cc343eb66de5077492686f582025c790a496804b8e6a36d49574ed9292fb3be0cf1178e

            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4249425805-3408538557-1766626484-1000\83aa4cc77f591dfc2374580bbd95f6ba_02510207-a8a1-401b-a8b2-969e44fe3fef

              Filesize

              45B

              MD5

              c8366ae350e7019aefc9d1e6e6a498c6

              SHA1

              5731d8a3e6568a5f2dfbbc87e3db9637df280b61

              SHA256

              11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

              SHA512

              33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

            • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

              Filesize

              359B

              MD5

              b20aad2670a5609512adb693ed6d378a

              SHA1

              d73f1650fc40c5e821d739a0cb1dfa39a7260832

              SHA256

              09797f593ff738891a54b2a55caed74038493183cbe4ca0249df85edb3b3479c

              SHA512

              1a49d7fe03e6652491f4e8d6f23a3360db6e030644f3a71ad23c058ac7a945a67c247b6f2d4ab3e37344c8ca9566b63f5181a9e1ef9a406d3d40b5add64fe22e

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

              Filesize

              3KB

              MD5

              e7e25fd019cc589ec80081ae3eb1cd69

              SHA1

              5fd0baeee4a375c85c4ed1b226599b128892fe19

              SHA256

              82d59717a7755000c265d77e1adbd5d74b17d1fc86a391daa5fd0ad09efd4911

              SHA512

              b0be3e8a7802cacd413485adf2e4fb70a0b77678cf217165614044a2b79c487b04c07523bd9fcc2436d9bf4ed3b88ca9778307f08268e7d0d0938528e4c764ea

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

              Filesize

              3KB

              MD5

              cabcf08a53dbb4e5ad107d23d12c791f

              SHA1

              1ff2298d7aeb346c85e67b2190c16c02e5ea99dd

              SHA256

              52dac7eaec9958c28454f6c94d81e0609cb4a5faff119045131db29c6b60ae89

              SHA512

              c9e568e25af15308d192c015eb6bf32f9881302d39c486a22bb4aebd11407157a9dc3cc16ee897ad0e477a7ce2358b7416771a5a08f72539aa800f90837d8fa2

            • memory/1288-126-0x000002143E7A0000-0x000002143E7B0000-memory.dmp

              Filesize

              64KB

            • memory/1288-222-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-40-0x000002143E7B0000-0x000002143E7C0000-memory.dmp

              Filesize

              64KB

            • memory/1288-27-0x000002143E790000-0x000002143E7A0000-memory.dmp

              Filesize

              64KB

            • memory/1288-26-0x000002143E780000-0x000002143E790000-memory.dmp

              Filesize

              64KB

            • memory/1288-83-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-36-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-45-0x000002143E7D0000-0x000002143E7E0000-memory.dmp

              Filesize

              64KB

            • memory/1288-41-0x000002143E7C0000-0x000002143E7D0000-memory.dmp

              Filesize

              64KB

            • memory/1288-107-0x000002143E510000-0x000002143E780000-memory.dmp

              Filesize

              2.4MB

            • memory/1288-47-0x000002143E7F0000-0x000002143E800000-memory.dmp

              Filesize

              64KB

            • memory/1288-46-0x000002143E7E0000-0x000002143E7F0000-memory.dmp

              Filesize

              64KB

            • memory/1288-115-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-118-0x000002143E780000-0x000002143E790000-memory.dmp

              Filesize

              64KB

            • memory/1288-119-0x000002143E790000-0x000002143E7A0000-memory.dmp

              Filesize

              64KB

            • memory/1288-221-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-2-0x000002143E510000-0x000002143E780000-memory.dmp

              Filesize

              2.4MB

            • memory/1288-128-0x000002143E7C0000-0x000002143E7D0000-memory.dmp

              Filesize

              64KB

            • memory/1288-127-0x000002143E7B0000-0x000002143E7C0000-memory.dmp

              Filesize

              64KB

            • memory/1288-136-0x000002143E7E0000-0x000002143E7F0000-memory.dmp

              Filesize

              64KB

            • memory/1288-137-0x000002143E7F0000-0x000002143E800000-memory.dmp

              Filesize

              64KB

            • memory/1288-166-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-39-0x000002143E7A0000-0x000002143E7B0000-memory.dmp

              Filesize

              64KB

            • memory/1288-181-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-185-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-187-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-195-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-198-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-200-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-210-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1288-209-0x000002143CD20000-0x000002143CD21000-memory.dmp

              Filesize

              4KB

            • memory/1572-172-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-122-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-111-0x0000024A6AE80000-0x0000024A6B0F0000-memory.dmp

              Filesize

              2.4MB

            • memory/1572-110-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-106-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-97-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-79-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-72-0x0000024A695C0000-0x0000024A695C1000-memory.dmp

              Filesize

              4KB

            • memory/1572-21-0x0000024A6AE80000-0x0000024A6B0F0000-memory.dmp

              Filesize

              2.4MB

            • memory/4280-227-0x00007FFEF8230000-0x00007FFEF8240000-memory.dmp

              Filesize

              64KB

            • memory/4280-229-0x00007FFEF8230000-0x00007FFEF8240000-memory.dmp

              Filesize

              64KB

            • memory/4280-228-0x00007FFEF8230000-0x00007FFEF8240000-memory.dmp

              Filesize

              64KB