bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar
Size

190KB
MD5

1a7a05db5686a51ce39c3b35c111d73f
SHA1

c6ba4712046569c3d6601e5d2f85aeecfabef69b
SHA256

bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493
SHA512

f15d3e2f5cd3a10111c87c2f6c1d8d7bf51fab14f9e6c33ffde067a5c7df2d7f81055d0ba331a840a33ba596cb45e782299f626367a928447a08480d41a3a1c9
SSDEEP

3072:OrYdkjhtVe7DDgZwqku/GLwlsA54LO/Q+7Jkb5o7/pJhHufYiYlDwVK/ASrx:etVqs+qku/aK4SzWU/ThHuQikDCHSd

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar\""	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar\""	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 2380	3784	java.exe	84
PID 3784 wrote to memory of 2380	3784	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar"
  2⤵
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493.jar

Filesize
190KB

MD5
1a7a05db5686a51ce39c3b35c111d73f

SHA1
c6ba4712046569c3d6601e5d2f85aeecfabef69b

SHA256
bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493

SHA512
f15d3e2f5cd3a10111c87c2f6c1d8d7bf51fab14f9e6c33ffde067a5c7df2d7f81055d0ba331a840a33ba596cb45e782299f626367a928447a08480d41a3a1c9

Download Submit
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
95497c7f9acaef08c706f252a2b9cf93

SHA1
54036801d6ed7d451ab9711d067f7cf61c2df3d7

SHA256
2d00f8e0926babb2ed561f2cdb700fd85e1e9c3255553e99c2a4b466105739ec

SHA512
5fb75a857d516e6531031210890aca0942ac9dc2c3799af66f3ef39e04dac9b6ac1531c23f20b782837a708db19d1502cddc312182607b06b14034a064ead814

Download Submit
memory/2380-73-0x000001C06B580000-0x000001C06B590000-memory.dmp

Filesize
64KB

Download
memory/2380-81-0x000001C06B530000-0x000001C06B540000-memory.dmp

Filesize
64KB

Download
memory/2380-91-0x000001C06B590000-0x000001C06B5A0000-memory.dmp

Filesize
64KB

Download
memory/2380-90-0x000001C06B590000-0x000001C06B5A0000-memory.dmp

Filesize
64KB

Download
memory/2380-86-0x000001C06B570000-0x000001C06B580000-memory.dmp

Filesize
64KB

Download
memory/2380-62-0x000001C06B520000-0x000001C06B530000-memory.dmp

Filesize
64KB

Download
memory/2380-85-0x000001C06B580000-0x000001C06B590000-memory.dmp

Filesize
64KB

Download
memory/2380-61-0x000001C06B510000-0x000001C06B520000-memory.dmp

Filesize
64KB

Download
memory/2380-84-0x000001C06B560000-0x000001C06B570000-memory.dmp

Filesize
64KB

Download
memory/2380-83-0x000001C06B550000-0x000001C06B560000-memory.dmp

Filesize
64KB

Download
memory/2380-82-0x000001C06B540000-0x000001C06B550000-memory.dmp

Filesize
64KB

Download
memory/2380-64-0x000001C06B530000-0x000001C06B540000-memory.dmp

Filesize
64KB

Download
memory/2380-80-0x000001C06B520000-0x000001C06B530000-memory.dmp

Filesize
64KB

Download
memory/2380-78-0x000001C06B510000-0x000001C06B520000-memory.dmp

Filesize
64KB

Download
memory/2380-77-0x000001C06B2A0000-0x000001C06B510000-memory.dmp

Filesize
2.4MB

Download
memory/2380-76-0x000001C06B280000-0x000001C06B281000-memory.dmp

Filesize
4KB

Download
memory/2380-49-0x000001C06B2A0000-0x000001C06B510000-memory.dmp

Filesize
2.4MB

Download
memory/2380-74-0x000001C06B570000-0x000001C06B580000-memory.dmp

Filesize
64KB

Download
memory/2380-72-0x000001C06B560000-0x000001C06B570000-memory.dmp

Filesize
64KB

Download
memory/2380-68-0x000001C06B550000-0x000001C06B560000-memory.dmp

Filesize
64KB

Download
memory/2380-66-0x000001C06B540000-0x000001C06B550000-memory.dmp

Filesize
64KB

Download
memory/3784-44-0x000002A8D3A00000-0x000002A8D3A10000-memory.dmp

Filesize
64KB

Download
memory/3784-25-0x000002A8D3A00000-0x000002A8D3A10000-memory.dmp

Filesize
64KB

Download
memory/3784-33-0x000002A8D3A10000-0x000002A8D3A20000-memory.dmp

Filesize
64KB

Download
memory/3784-21-0x000002A8D39E0000-0x000002A8D39F0000-memory.dmp

Filesize
64KB

Download
memory/3784-37-0x000002A8D3730000-0x000002A8D39A0000-memory.dmp

Filesize
2.4MB

Download
memory/3784-38-0x000002A8D39A0000-0x000002A8D39B0000-memory.dmp

Filesize
64KB

Download
memory/3784-39-0x000002A8D39B0000-0x000002A8D39C0000-memory.dmp

Filesize
64KB

Download
memory/3784-2-0x000002A8D3730000-0x000002A8D39A0000-memory.dmp

Filesize
2.4MB

Download
memory/3784-40-0x000002A8D39C0000-0x000002A8D39D0000-memory.dmp

Filesize
64KB

Download
memory/3784-41-0x000002A8D39D0000-0x000002A8D39E0000-memory.dmp

Filesize
64KB

Download
memory/3784-42-0x000002A8D39E0000-0x000002A8D39F0000-memory.dmp

Filesize
64KB

Download
memory/3784-43-0x000002A8D39F0000-0x000002A8D3A00000-memory.dmp

Filesize
64KB

Download
memory/3784-16-0x000002A8D39C0000-0x000002A8D39D0000-memory.dmp

Filesize
64KB

Download
memory/3784-45-0x000002A8D3A20000-0x000002A8D3A30000-memory.dmp

Filesize
64KB

Download
memory/3784-35-0x000002A8D3710000-0x000002A8D3711000-memory.dmp

Filesize
4KB

Download
memory/3784-14-0x000002A8D39B0000-0x000002A8D39C0000-memory.dmp

Filesize
64KB

Download
memory/3784-34-0x000002A8D3A20000-0x000002A8D3A30000-memory.dmp

Filesize
64KB

Download
memory/3784-20-0x000002A8D39D0000-0x000002A8D39E0000-memory.dmp

Filesize
64KB

Download
memory/3784-12-0x000002A8D39A0000-0x000002A8D39B0000-memory.dmp

Filesize
64KB

Download
memory/3784-22-0x000002A8D39F0000-0x000002A8D3A00000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads