Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 03:14
Behavioral task
behavioral1
Sample
Shipping Bill6239999 dated 13122024.PDF.jar
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Shipping Bill6239999 dated 13122024.PDF.jar
Resource
win10v2004-20241007-en
General
-
Target
Shipping Bill6239999 dated 13122024.PDF.jar
-
Size
196KB
-
MD5
01fd77362fbe5b158352d203bf4e264d
-
SHA1
b707961bf70f6798103b0f9dcf516ca3fb63a52f
-
SHA256
9dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b
-
SHA512
c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7
-
SSDEEP
3072:lROA9tlCGC9tKioY4Ql1wVa3CZGfteVTIglU5N0cVfG6lLAANinz94ZC6vr5:/9/LC9sGVNSZGfteVTAjJ1qANmx4x
Malware Config
Signatures
-
Strrat family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill6239999 dated 13122024.PDF.jar java.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Bill6239999 dated 13122024.PDF = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Bill6239999 dated 13122024.PDF.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Shipping Bill6239999 dated 13122024.PDF = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Shipping Bill6239999 dated 13122024.PDF.jar\"" java.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 428 cmd.exe 960 java.exe 2324 java.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5008 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3268 WMIC.exe Token: SeSecurityPrivilege 3268 WMIC.exe Token: SeTakeOwnershipPrivilege 3268 WMIC.exe Token: SeLoadDriverPrivilege 3268 WMIC.exe Token: SeSystemProfilePrivilege 3268 WMIC.exe Token: SeSystemtimePrivilege 3268 WMIC.exe Token: SeProfSingleProcessPrivilege 3268 WMIC.exe Token: SeIncBasePriorityPrivilege 3268 WMIC.exe Token: SeCreatePagefilePrivilege 3268 WMIC.exe Token: SeBackupPrivilege 3268 WMIC.exe Token: SeRestorePrivilege 3268 WMIC.exe Token: SeShutdownPrivilege 3268 WMIC.exe Token: SeDebugPrivilege 3268 WMIC.exe Token: SeSystemEnvironmentPrivilege 3268 WMIC.exe Token: SeRemoteShutdownPrivilege 3268 WMIC.exe Token: SeUndockPrivilege 3268 WMIC.exe Token: SeManageVolumePrivilege 3268 WMIC.exe Token: 33 3268 WMIC.exe Token: 34 3268 WMIC.exe Token: 35 3268 WMIC.exe Token: 36 3268 WMIC.exe Token: SeIncreaseQuotaPrivilege 3268 WMIC.exe Token: SeSecurityPrivilege 3268 WMIC.exe Token: SeTakeOwnershipPrivilege 3268 WMIC.exe Token: SeLoadDriverPrivilege 3268 WMIC.exe Token: SeSystemProfilePrivilege 3268 WMIC.exe Token: SeSystemtimePrivilege 3268 WMIC.exe Token: SeProfSingleProcessPrivilege 3268 WMIC.exe Token: SeIncBasePriorityPrivilege 3268 WMIC.exe Token: SeCreatePagefilePrivilege 3268 WMIC.exe Token: SeBackupPrivilege 3268 WMIC.exe Token: SeRestorePrivilege 3268 WMIC.exe Token: SeShutdownPrivilege 3268 WMIC.exe Token: SeDebugPrivilege 3268 WMIC.exe Token: SeSystemEnvironmentPrivilege 3268 WMIC.exe Token: SeRemoteShutdownPrivilege 3268 WMIC.exe Token: SeUndockPrivilege 3268 WMIC.exe Token: SeManageVolumePrivilege 3268 WMIC.exe Token: 33 3268 WMIC.exe Token: 34 3268 WMIC.exe Token: 35 3268 WMIC.exe Token: 36 3268 WMIC.exe Token: SeIncreaseQuotaPrivilege 4808 WMIC.exe Token: SeSecurityPrivilege 4808 WMIC.exe Token: SeTakeOwnershipPrivilege 4808 WMIC.exe Token: SeLoadDriverPrivilege 4808 WMIC.exe Token: SeSystemProfilePrivilege 4808 WMIC.exe Token: SeSystemtimePrivilege 4808 WMIC.exe Token: SeProfSingleProcessPrivilege 4808 WMIC.exe Token: SeIncBasePriorityPrivilege 4808 WMIC.exe Token: SeCreatePagefilePrivilege 4808 WMIC.exe Token: SeBackupPrivilege 4808 WMIC.exe Token: SeRestorePrivilege 4808 WMIC.exe Token: SeShutdownPrivilege 4808 WMIC.exe Token: SeDebugPrivilege 4808 WMIC.exe Token: SeSystemEnvironmentPrivilege 4808 WMIC.exe Token: SeRemoteShutdownPrivilege 4808 WMIC.exe Token: SeUndockPrivilege 4808 WMIC.exe Token: SeManageVolumePrivilege 4808 WMIC.exe Token: 33 4808 WMIC.exe Token: 34 4808 WMIC.exe Token: 35 4808 WMIC.exe Token: 36 4808 WMIC.exe Token: SeIncreaseQuotaPrivilege 4808 WMIC.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2324 wrote to memory of 428 2324 java.exe 83 PID 2324 wrote to memory of 428 2324 java.exe 83 PID 2324 wrote to memory of 960 2324 java.exe 85 PID 2324 wrote to memory of 960 2324 java.exe 85 PID 428 wrote to memory of 5008 428 cmd.exe 87 PID 428 wrote to memory of 5008 428 cmd.exe 87 PID 960 wrote to memory of 3980 960 java.exe 88 PID 960 wrote to memory of 3980 960 java.exe 88 PID 3980 wrote to memory of 3268 3980 cmd.exe 90 PID 3980 wrote to memory of 3268 3980 cmd.exe 90 PID 960 wrote to memory of 2704 960 java.exe 92 PID 960 wrote to memory of 2704 960 java.exe 92 PID 2704 wrote to memory of 4808 2704 cmd.exe 94 PID 2704 wrote to memory of 4808 2704 cmd.exe 94 PID 960 wrote to memory of 5040 960 java.exe 95 PID 960 wrote to memory of 5040 960 java.exe 95 PID 5040 wrote to memory of 4732 5040 cmd.exe 97 PID 5040 wrote to memory of 4732 5040 cmd.exe 97 PID 960 wrote to memory of 4092 960 java.exe 98 PID 960 wrote to memory of 4092 960 java.exe 98 PID 4092 wrote to memory of 4772 4092 cmd.exe 100 PID 4092 wrote to memory of 4772 4092 cmd.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Shipping Bill6239999 dated 13122024.PDF.jar"1⤵
- Drops startup file
- Adds Run key to start application
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"3⤵
- Scheduled Task/Job: Scheduled Task
PID:5008
-
-
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Shipping Bill6239999 dated 13122024.PDF.jar"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3268
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4808
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list4⤵PID:4732
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list"3⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\Wbem\WMIC.exewmic /node:localhost /namespace:'\\root\securitycenter2' path antivirusproduct get displayname /format:list4⤵PID:4772
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill6239999 dated 13122024.PDF.jar
Filesize196KB
MD501fd77362fbe5b158352d203bf4e264d
SHA1b707961bf70f6798103b0f9dcf516ca3fb63a52f
SHA2569dbfb2b2c624a39591fd60397997ae7d9c09896862b5d97c5db3c7dd6c6d902b
SHA512c64d87211760ece2e76ed4bd9255d2f728159ced3a03bdfac28fa17d9b0f452d73e0ef62521ec354a44657028acea8e620620c1a4d3c0c4a91612d5c347288d7
-
Filesize
46B
MD5c497e8d0d9cb615c4d8156e49f1544d6
SHA18e2361f0c32e83db99a6d68a89f61cc984ca8c8e
SHA256e8afa75d2d66bd314faece9c7f99e5e1bbada83b84f97a33dacabc1ef589d670
SHA512cdce5eb1e32698ceb790f8184dc13b4fa6ab5d7bc50c38d8879efe2ed75f567f6b152a0e3f438d47bfedb81dc49f7f8a2a42040617790a42603070ee9f39039c