Analysis

  • max time kernel
    295s
  • max time network
    298s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/06/2025, 18:29

General

  • Target

    Shipping Bill2806083 dated 28062025.PDF.jar

  • Size

    207KB

  • MD5

    8a30b5e4b7e88307428e06d20a2c215e

  • SHA1

    258651d8b434c450f31d0ca53f7b3b0777fd6532

  • SHA256

    d4a0cff4585e4c3f173848935b24350a882edd846dc58a52cff5809a30e38cc9

  • SHA512

    2c8f5062f0ef5c59fce3dda07317695b3059c743e687fcb0422eadb62c745e9db5166be9ca924e521276d3a2b7b66d0a2ca1ff7d029c43c3eb8cd258570c7f94

  • SSDEEP

    3072:eJYejZsTG036ohReYl2JMTs6kebaXD9Ce5Dl6Vqc4iKSW+1/jVUXLRNRb0A+q/ol:KYYev36ohts2KZDlmqc8g/psv+TaoSWH

Malware Config

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

  • Strrat family
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Shipping Bill2806083 dated 28062025.PDF.jar"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5184
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3508
    • C:\Program Files\Java\jre-1.8\bin\java.exe
      "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4544
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\Shipping Bill2806083 dated 28062025.PDF.jar"
    1⤵
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:5172

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Shipping Bill2806083 dated 28062025.PDF.jar

          Filesize

          207KB

          MD5

          8a30b5e4b7e88307428e06d20a2c215e

          SHA1

          258651d8b434c450f31d0ca53f7b3b0777fd6532

          SHA256

          d4a0cff4585e4c3f173848935b24350a882edd846dc58a52cff5809a30e38cc9

          SHA512

          2c8f5062f0ef5c59fce3dda07317695b3059c743e687fcb0422eadb62c745e9db5166be9ca924e521276d3a2b7b66d0a2ca1ff7d029c43c3eb8cd258570c7f94

        • memory/1472-44-0x000001D6802E0000-0x000001D6802F0000-memory.dmp

          Filesize

          64KB

        • memory/1472-14-0x000001D680280000-0x000001D680290000-memory.dmp

          Filesize

          64KB

        • memory/1472-20-0x000001D6802B0000-0x000001D6802C0000-memory.dmp

          Filesize

          64KB

        • memory/1472-19-0x000001D6802A0000-0x000001D6802B0000-memory.dmp

          Filesize

          64KB

        • memory/1472-23-0x000001D6802C0000-0x000001D6802D0000-memory.dmp

          Filesize

          64KB

        • memory/1472-24-0x000001D6802D0000-0x000001D6802E0000-memory.dmp

          Filesize

          64KB

        • memory/1472-26-0x000001D6802E0000-0x000001D6802F0000-memory.dmp

          Filesize

          64KB

        • memory/1472-42-0x000001D6802C0000-0x000001D6802D0000-memory.dmp

          Filesize

          64KB

        • memory/1472-43-0x000001D6802D0000-0x000001D6802E0000-memory.dmp

          Filesize

          64KB

        • memory/1472-34-0x000001D6F8F50000-0x000001D6F8F51000-memory.dmp

          Filesize

          4KB

        • memory/1472-16-0x000001D680290000-0x000001D6802A0000-memory.dmp

          Filesize

          64KB

        • memory/1472-2-0x000001D680000000-0x000001D680270000-memory.dmp

          Filesize

          2.4MB

        • memory/1472-28-0x000001D6802F0000-0x000001D680300000-memory.dmp

          Filesize

          64KB

        • memory/1472-41-0x000001D6802B0000-0x000001D6802C0000-memory.dmp

          Filesize

          64KB

        • memory/1472-40-0x000001D6802A0000-0x000001D6802B0000-memory.dmp

          Filesize

          64KB

        • memory/1472-39-0x000001D680290000-0x000001D6802A0000-memory.dmp

          Filesize

          64KB

        • memory/1472-38-0x000001D680280000-0x000001D680290000-memory.dmp

          Filesize

          64KB

        • memory/1472-37-0x000001D680270000-0x000001D680280000-memory.dmp

          Filesize

          64KB

        • memory/1472-36-0x000001D680000000-0x000001D680270000-memory.dmp

          Filesize

          2.4MB

        • memory/1472-12-0x000001D680270000-0x000001D680280000-memory.dmp

          Filesize

          64KB

        • memory/4544-48-0x0000026880000000-0x0000026880270000-memory.dmp

          Filesize

          2.4MB

        • memory/4544-67-0x00000268F5ED0000-0x00000268F5ED1000-memory.dmp

          Filesize

          4KB

        • memory/4544-69-0x0000026880000000-0x0000026880270000-memory.dmp

          Filesize

          2.4MB