Analysis

  • max time kernel
    93s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 02:28

General

  • Target

    yedek-main/Ja4va.jar

  • Size

    1.7MB

  • MD5

    6d729b3dda0471989f1efdf02abfe1b5

  • SHA1

    c8273107db98ac14930dd01f2fff66ebb7cc8df4

  • SHA256

    d1200740675d379b2aae43691a3014912bcd413b717cecb90e49cd640e31fd61

  • SHA512

    4bd26fec9dbf840aa77770cbb7f392c77557e85f0beff8ce888df5b1fc942952e34b7617f03087fa24272cc662bc47949c6083efbb923f6c23db4e9b8866b8f3

  • SSDEEP

    24576:X5yR2a7sHTRRWyQZuGTlC9zcg4I8Rt0GR5SJrr7ST+GlGQTIL3wIkmv8DCQmzg:JEOHTRMw8kpxnynRF+GlGQTIL+mUDCQv

Score
10/10

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\yedek-main\Ja4va.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\SYSTEM32\reg.exe
      reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      2⤵
      • UAC bypass
      • Modifies registry key
      PID:3284
    • C:\Windows\SYSTEM32\reg.exe
      reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v CheckedPath /t REG_SZ /d c:\windows\system32\SecurityHealthSystray.exe /f
      2⤵
        PID:840
      • C:\Windows\SYSTEM32\reg.exe
        reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v DisableReminders /t REG_DWORD /d 1 /f
        2⤵
          PID:2296
        • C:\Windows\SYSTEM32\reg.exe
          reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0" /v StateFlags /t REG_DWORD /d 3 /f
          2⤵
            PID:2448

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2456-2-0x00000292C8610000-0x00000292C8880000-memory.dmp

          Filesize

          2.4MB

        • memory/2456-14-0x00000292C6E40000-0x00000292C6E41000-memory.dmp

          Filesize

          4KB

        • memory/2456-15-0x00000292C8610000-0x00000292C8880000-memory.dmp

          Filesize

          2.4MB