Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-02-2025 02:34

General

  • Target

    TTPayment.jar

  • Size

    267KB

  • MD5

    b4bc577b9b011c29d04f7e3797f5b4c0

  • SHA1

    dd5f810d906cd61a8ec78c28841a121fbaa88d6f

  • SHA256

    fe02be2dc318367898f962aa9c3415ff96d95526aa6f6efd72764a732f3b745c

  • SHA512

    12eba3aacb580eaf11dc9a9aec39ad5e926d053fc8e6fb6871153e22bfb2627628a64f3e931855ff772e63bb152862b7c59292345489085068e8e5c3263ecfa4

  • SSDEEP

    3072:fIMXATbZOaBKsPUVx4lboHQMg5CBklnIVSPxk/ISc6iTpoP6vBum4ggH9AoGa+:gAATbZiDPPqlISPW/IlFg6ZuZ+a+

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\TTPayment.jar
    1⤵
      PID:4492
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzJCQTkzQTUtNURGNS00NUQzLTgxRDItQkM1RTZDMENCRTU1fSIgdXNlcmlkPSJ7QTlCNDk0OEYtNjMxNi00N0VELUFGRkUtMjY2MDJCMTJEQzk5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OEE2MTc2RkEtNEM0NS00QkQzLThBQjUtRjkxMjU2MURBNzFDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDQ5MjgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxNzQzMjM4OTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTg5ODE3NjQ2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:3164

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4492-2-0x000001C080000000-0x000001C080270000-memory.dmp

      Filesize

      2.4MB

    • memory/4492-12-0x000001C080270000-0x000001C080280000-memory.dmp

      Filesize

      64KB

    • memory/4492-14-0x000001C080280000-0x000001C080290000-memory.dmp

      Filesize

      64KB

    • memory/4492-16-0x000001C080290000-0x000001C0802A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-19-0x000001C0802A0000-0x000001C0802B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-20-0x000001C0802B0000-0x000001C0802C0000-memory.dmp

      Filesize

      64KB

    • memory/4492-23-0x000001C0802C0000-0x000001C0802D0000-memory.dmp

      Filesize

      64KB

    • memory/4492-25-0x000001C0802D0000-0x000001C0802E0000-memory.dmp

      Filesize

      64KB

    • memory/4492-31-0x000001C0802E0000-0x000001C0802F0000-memory.dmp

      Filesize

      64KB

    • memory/4492-37-0x000001C080320000-0x000001C080330000-memory.dmp

      Filesize

      64KB

    • memory/4492-39-0x000001C080310000-0x000001C080320000-memory.dmp

      Filesize

      64KB

    • memory/4492-38-0x000001C080300000-0x000001C080310000-memory.dmp

      Filesize

      64KB

    • memory/4492-36-0x000001C080000000-0x000001C080270000-memory.dmp

      Filesize

      2.4MB

    • memory/4492-34-0x000001C0802F0000-0x000001C080300000-memory.dmp

      Filesize

      64KB

    • memory/4492-40-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-43-0x000001C080330000-0x000001C080340000-memory.dmp

      Filesize

      64KB

    • memory/4492-46-0x000001C080280000-0x000001C080290000-memory.dmp

      Filesize

      64KB

    • memory/4492-49-0x000001C080290000-0x000001C0802A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-48-0x000001C080350000-0x000001C080360000-memory.dmp

      Filesize

      64KB

    • memory/4492-47-0x000001C080340000-0x000001C080350000-memory.dmp

      Filesize

      64KB

    • memory/4492-42-0x000001C080270000-0x000001C080280000-memory.dmp

      Filesize

      64KB

    • memory/4492-52-0x000001C080360000-0x000001C080370000-memory.dmp

      Filesize

      64KB

    • memory/4492-51-0x000001C0802A0000-0x000001C0802B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-55-0x000001C080370000-0x000001C080380000-memory.dmp

      Filesize

      64KB

    • memory/4492-54-0x000001C0802B0000-0x000001C0802C0000-memory.dmp

      Filesize

      64KB

    • memory/4492-60-0x000001C080380000-0x000001C080390000-memory.dmp

      Filesize

      64KB

    • memory/4492-59-0x000001C0802C0000-0x000001C0802D0000-memory.dmp

      Filesize

      64KB

    • memory/4492-61-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-64-0x000001C0802D0000-0x000001C0802E0000-memory.dmp

      Filesize

      64KB

    • memory/4492-66-0x000001C080390000-0x000001C0803A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-72-0x000001C080320000-0x000001C080330000-memory.dmp

      Filesize

      64KB

    • memory/4492-70-0x000001C0803A0000-0x000001C0803B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-71-0x000001C0802F0000-0x000001C080300000-memory.dmp

      Filesize

      64KB

    • memory/4492-78-0x000001C0803C0000-0x000001C0803D0000-memory.dmp

      Filesize

      64KB

    • memory/4492-77-0x000001C080330000-0x000001C080340000-memory.dmp

      Filesize

      64KB

    • memory/4492-76-0x000001C0803B0000-0x000001C0803C0000-memory.dmp

      Filesize

      64KB

    • memory/4492-75-0x000001C080310000-0x000001C080320000-memory.dmp

      Filesize

      64KB

    • memory/4492-74-0x000001C080300000-0x000001C080310000-memory.dmp

      Filesize

      64KB

    • memory/4492-69-0x000001C0802E0000-0x000001C0802F0000-memory.dmp

      Filesize

      64KB

    • memory/4492-90-0x000001C080400000-0x000001C080410000-memory.dmp

      Filesize

      64KB

    • memory/4492-89-0x000001C0803F0000-0x000001C080400000-memory.dmp

      Filesize

      64KB

    • memory/4492-88-0x000001C0803E0000-0x000001C0803F0000-memory.dmp

      Filesize

      64KB

    • memory/4492-87-0x000001C0803D0000-0x000001C0803E0000-memory.dmp

      Filesize

      64KB

    • memory/4492-86-0x000001C080350000-0x000001C080360000-memory.dmp

      Filesize

      64KB

    • memory/4492-85-0x000001C080340000-0x000001C080350000-memory.dmp

      Filesize

      64KB

    • memory/4492-94-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-95-0x000001C080360000-0x000001C080370000-memory.dmp

      Filesize

      64KB

    • memory/4492-96-0x000001C080410000-0x000001C080420000-memory.dmp

      Filesize

      64KB

    • memory/4492-99-0x000001C080420000-0x000001C080430000-memory.dmp

      Filesize

      64KB

    • memory/4492-98-0x000001C080370000-0x000001C080380000-memory.dmp

      Filesize

      64KB

    • memory/4492-101-0x000001C080380000-0x000001C080390000-memory.dmp

      Filesize

      64KB

    • memory/4492-102-0x000001C080430000-0x000001C080440000-memory.dmp

      Filesize

      64KB

    • memory/4492-106-0x000001C080440000-0x000001C080450000-memory.dmp

      Filesize

      64KB

    • memory/4492-105-0x000001C0803A0000-0x000001C0803B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-104-0x000001C080390000-0x000001C0803A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-107-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-109-0x000001C0803A0000-0x000001C0803B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-111-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-113-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-116-0x000001C080450000-0x000001C080460000-memory.dmp

      Filesize

      64KB

    • memory/4492-118-0x000001C0803B0000-0x000001C0803C0000-memory.dmp

      Filesize

      64KB

    • memory/4492-119-0x000001C080460000-0x000001C080470000-memory.dmp

      Filesize

      64KB

    • memory/4492-120-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-122-0x000001C0803C0000-0x000001C0803D0000-memory.dmp

      Filesize

      64KB

    • memory/4492-123-0x000001C080470000-0x000001C080480000-memory.dmp

      Filesize

      64KB

    • memory/4492-125-0x000001C0803D0000-0x000001C0803E0000-memory.dmp

      Filesize

      64KB

    • memory/4492-126-0x000001C0803E0000-0x000001C0803F0000-memory.dmp

      Filesize

      64KB

    • memory/4492-127-0x000001C0803F0000-0x000001C080400000-memory.dmp

      Filesize

      64KB

    • memory/4492-128-0x000001C080400000-0x000001C080410000-memory.dmp

      Filesize

      64KB

    • memory/4492-130-0x000001C080410000-0x000001C080420000-memory.dmp

      Filesize

      64KB

    • memory/4492-131-0x000001C080420000-0x000001C080430000-memory.dmp

      Filesize

      64KB

    • memory/4492-132-0x000001C080430000-0x000001C080440000-memory.dmp

      Filesize

      64KB

    • memory/4492-133-0x000001C080440000-0x000001C080450000-memory.dmp

      Filesize

      64KB

    • memory/4492-135-0x000001C080450000-0x000001C080460000-memory.dmp

      Filesize

      64KB

    • memory/4492-136-0x000001C080460000-0x000001C080470000-memory.dmp

      Filesize

      64KB

    • memory/4492-137-0x000001C080480000-0x000001C080490000-memory.dmp

      Filesize

      64KB

    • memory/4492-140-0x000001C080470000-0x000001C080480000-memory.dmp

      Filesize

      64KB

    • memory/4492-141-0x000001C080490000-0x000001C0804A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-144-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-147-0x000001C0FC770000-0x000001C0FC771000-memory.dmp

      Filesize

      4KB

    • memory/4492-148-0x000001C080480000-0x000001C080490000-memory.dmp

      Filesize

      64KB

    • memory/4492-149-0x000001C080490000-0x000001C0804A0000-memory.dmp

      Filesize

      64KB

    • memory/4492-155-0x000001C0804A0000-0x000001C0804B0000-memory.dmp

      Filesize

      64KB

    • memory/4492-157-0x000001C0804A0000-0x000001C0804B0000-memory.dmp

      Filesize

      64KB