4ad426172639516e2dd5e98c32f670db5457065c05f8ab87269459eebb057552

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

yedek-main/Java.jar
Size

1.7MB
MD5

6d729b3dda0471989f1efdf02abfe1b5
SHA1

c8273107db98ac14930dd01f2fff66ebb7cc8df4
SHA256

d1200740675d379b2aae43691a3014912bcd413b717cecb90e49cd640e31fd61
SHA512

4bd26fec9dbf840aa77770cbb7f392c77557e85f0beff8ce888df5b1fc942952e34b7617f03087fa24272cc662bc47949c6083efbb923f6c23db4e9b8866b8f3
SSDEEP

24576:X5yR2a7sHTRRWyQZuGTlC9zcg4I8Rt0GR5SJrr7ST+GlGQTIL3wIkmv8DCQmzg:JEOHTRMw8kpxnynRF+GlGQTIL+mUDCQv

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2324	reg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 2324	4024	java.exe	86
PID 4024 wrote to memory of 2324	4024	java.exe	86
PID 4024 wrote to memory of 5104	4024	java.exe	88
PID 4024 wrote to memory of 5104	4024	java.exe	88
PID 4024 wrote to memory of 1852	4024	java.exe	90
PID 4024 wrote to memory of 1852	4024	java.exe	90
PID 4024 wrote to memory of 1660	4024	java.exe	92
PID 4024 wrote to memory of 1660	4024	java.exe	92

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\yedek-main\Java.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:2324
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v CheckedPath /t REG_SZ /d c:\windows\system32\SecurityHealthSystray.exe /f
  2⤵
  PID:5104
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v DisableReminders /t REG_DWORD /d 1 /f
  2⤵
  PID:1852
- C:\Windows\SYSTEM32\reg.exe
  reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v StateFlags /t REG_DWORD /d 3 /f
  2⤵
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4024-2-0x0000021450990000-0x0000021450C00000-memory.dmp

Filesize
2.4MB

Download
memory/4024-11-0x000002144EF80000-0x000002144EF81000-memory.dmp

Filesize
4KB

Download
memory/4024-15-0x000002144EF80000-0x000002144EF81000-memory.dmp

Filesize
4KB

Download
memory/4024-16-0x0000021450990000-0x0000021450C00000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads