2fe7c40f98b2bf290d97c1a504985ddcd74ba9607761d66ec04c27b623c60d5f

Analysis

max time kernel
49s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PrestigeInjector.jar
Size

155KB
MD5

bb659e66ccc62be59e71ce62898e8062
SHA1

369c25253f421250ad0db8f5194cebddfb421554
SHA256

2fe7c40f98b2bf290d97c1a504985ddcd74ba9607761d66ec04c27b623c60d5f
SHA512

30f8a114e7f1a0f128f83f9c542d91067beb3cb1a2bf745ec4836be9553e5fc7740d59f3501176aab00213ff44f1d437266dd0074d311b76ff26efc32f1a6d3e
SSDEEP

3072:F+X10rLJP1LV8ta2cLgZD8T32h3Idc6o+dN7Ny/0XVwL:F++yt1ugZDU2hccC/2

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe Java bridge = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\AIR\\jre13v3bridge.jar"	REG.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1336	REG.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4524	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1336	4524	java.exe	84
PID 4524 wrote to memory of 1336	4524	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PrestigeInjector.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Adobe Java bridge" /d "C:\Users\Admin\AppData\Roaming\Adobe\AIR\jre13v3bridge.jar"
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4524-2-0x0000026D00000000-0x0000026D00270000-memory.dmp

Filesize
2.4MB

Download
memory/4524-15-0x0000026D7F1A0000-0x0000026D7F1A1000-memory.dmp

Filesize
4KB

Download
memory/4524-17-0x0000026D00000000-0x0000026D00270000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads