Analysis

  • max time kernel
    293s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2025, 18:29

General

  • Target

    Shipping Bill2806083 dated 28062025.PDF.jar

  • Size

    207KB

  • MD5

    8a30b5e4b7e88307428e06d20a2c215e

  • SHA1

    258651d8b434c450f31d0ca53f7b3b0777fd6532

  • SHA256

    d4a0cff4585e4c3f173848935b24350a882edd846dc58a52cff5809a30e38cc9

  • SHA512

    2c8f5062f0ef5c59fce3dda07317695b3059c743e687fcb0422eadb62c745e9db5166be9ca924e521276d3a2b7b66d0a2ca1ff7d029c43c3eb8cd258570c7f94

  • SSDEEP

    3072:eJYejZsTG036ohReYl2JMTs6kebaXD9Ce5Dl6Vqc4iKSW+1/jVUXLRNRb0A+q/ol:KYYev36ohts2KZDlmqc8g/psv+TaoSWH

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Strrat family
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Shipping Bill2806083 dated 28062025.PDF.jar"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5668
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4560
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2908
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
    1⤵
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Shipping Bill2806083 dated 28062025.PDF.jar

          Filesize

          207KB

          MD5

          8a30b5e4b7e88307428e06d20a2c215e

          SHA1

          258651d8b434c450f31d0ca53f7b3b0777fd6532

          SHA256

          d4a0cff4585e4c3f173848935b24350a882edd846dc58a52cff5809a30e38cc9

          SHA512

          2c8f5062f0ef5c59fce3dda07317695b3059c743e687fcb0422eadb62c745e9db5166be9ca924e521276d3a2b7b66d0a2ca1ff7d029c43c3eb8cd258570c7f94

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          24e065d0ebd8442d90edae56e3eda8d3

          SHA1

          6f848b248203f11fe3d14b0b54a94e71e04500db

          SHA256

          180b67a9611e296d6a472cef416b335c135b469c74e66bb878e825a583f55631

          SHA512

          b3d7389ddaca45fa7dd86af0e966a19bb51bfd2095c3db38fdcc228bd77fe27b9d94705d00c2ae98af23678f012901a7302c638bfa63a7ece53c4178a3c294f5

        • memory/1448-41-0x000001D0EC310000-0x000001D0EC320000-memory.dmp

          Filesize

          64KB

        • memory/1448-46-0x000001D0EC360000-0x000001D0EC370000-memory.dmp

          Filesize

          64KB

        • memory/1448-18-0x000001D0EC330000-0x000001D0EC340000-memory.dmp

          Filesize

          64KB

        • memory/1448-24-0x000001D0EC360000-0x000001D0EC370000-memory.dmp

          Filesize

          64KB

        • memory/1448-23-0x000001D0EC350000-0x000001D0EC360000-memory.dmp

          Filesize

          64KB

        • memory/1448-22-0x000001D0EC340000-0x000001D0EC350000-memory.dmp

          Filesize

          64KB

        • memory/1448-27-0x000001D0EC370000-0x000001D0EC380000-memory.dmp

          Filesize

          64KB

        • memory/1448-29-0x000001D0EC380000-0x000001D0EC390000-memory.dmp

          Filesize

          64KB

        • memory/1448-30-0x000001D0EC390000-0x000001D0EC3A0000-memory.dmp

          Filesize

          64KB

        • memory/1448-36-0x000001D0EA830000-0x000001D0EA831000-memory.dmp

          Filesize

          4KB

        • memory/1448-13-0x000001D0EC300000-0x000001D0EC310000-memory.dmp

          Filesize

          64KB

        • memory/1448-39-0x000001D0EC090000-0x000001D0EC300000-memory.dmp

          Filesize

          2.4MB

        • memory/1448-49-0x000001D0EC390000-0x000001D0EC3A0000-memory.dmp

          Filesize

          64KB

        • memory/1448-48-0x000001D0EC380000-0x000001D0EC390000-memory.dmp

          Filesize

          64KB

        • memory/1448-47-0x000001D0EC370000-0x000001D0EC380000-memory.dmp

          Filesize

          64KB

        • memory/1448-14-0x000001D0EC310000-0x000001D0EC320000-memory.dmp

          Filesize

          64KB

        • memory/1448-45-0x000001D0EC350000-0x000001D0EC360000-memory.dmp

          Filesize

          64KB

        • memory/1448-44-0x000001D0EC340000-0x000001D0EC350000-memory.dmp

          Filesize

          64KB

        • memory/1448-43-0x000001D0EC330000-0x000001D0EC340000-memory.dmp

          Filesize

          64KB

        • memory/1448-42-0x000001D0EC320000-0x000001D0EC330000-memory.dmp

          Filesize

          64KB

        • memory/1448-2-0x000001D0EC090000-0x000001D0EC300000-memory.dmp

          Filesize

          2.4MB

        • memory/1448-40-0x000001D0EC300000-0x000001D0EC310000-memory.dmp

          Filesize

          64KB

        • memory/1448-17-0x000001D0EC320000-0x000001D0EC330000-memory.dmp

          Filesize

          64KB

        • memory/2908-78-0x000001BBB2990000-0x000001BBB29A0000-memory.dmp

          Filesize

          64KB

        • memory/2908-76-0x000001BBB2970000-0x000001BBB2980000-memory.dmp

          Filesize

          64KB

        • memory/2908-66-0x000001BBB2930000-0x000001BBB2940000-memory.dmp

          Filesize

          64KB

        • memory/2908-68-0x000001BBB2940000-0x000001BBB2950000-memory.dmp

          Filesize

          64KB

        • memory/2908-73-0x000001BBB2960000-0x000001BBB2970000-memory.dmp

          Filesize

          64KB

        • memory/2908-72-0x000001BBB2950000-0x000001BBB2960000-memory.dmp

          Filesize

          64KB

        • memory/2908-82-0x000001BBB26B0000-0x000001BBB2920000-memory.dmp

          Filesize

          2.4MB

        • memory/2908-81-0x000001BBB2690000-0x000001BBB2691000-memory.dmp

          Filesize

          4KB

        • memory/2908-77-0x000001BBB2980000-0x000001BBB2990000-memory.dmp

          Filesize

          64KB

        • memory/2908-83-0x000001BBB2920000-0x000001BBB2930000-memory.dmp

          Filesize

          64KB

        • memory/2908-64-0x000001BBB2920000-0x000001BBB2930000-memory.dmp

          Filesize

          64KB

        • memory/2908-80-0x000001BBB29A0000-0x000001BBB29B0000-memory.dmp

          Filesize

          64KB

        • memory/2908-53-0x000001BBB26B0000-0x000001BBB2920000-memory.dmp

          Filesize

          2.4MB

        • memory/2908-84-0x000001BBB2930000-0x000001BBB2940000-memory.dmp

          Filesize

          64KB

        • memory/2908-86-0x000001BBB2940000-0x000001BBB2950000-memory.dmp

          Filesize

          64KB

        • memory/2908-88-0x000001BBB2960000-0x000001BBB2970000-memory.dmp

          Filesize

          64KB

        • memory/2908-87-0x000001BBB2950000-0x000001BBB2960000-memory.dmp

          Filesize

          64KB

        • memory/2908-89-0x000001BBB2970000-0x000001BBB2980000-memory.dmp

          Filesize

          64KB

        • memory/2908-91-0x000001BBB2990000-0x000001BBB29A0000-memory.dmp

          Filesize

          64KB

        • memory/2908-90-0x000001BBB2980000-0x000001BBB2990000-memory.dmp

          Filesize

          64KB

        • memory/2908-92-0x000001BBB29A0000-0x000001BBB29B0000-memory.dmp

          Filesize

          64KB

        • memory/2908-95-0x000001BBB29B0000-0x000001BBB29C0000-memory.dmp

          Filesize

          64KB