Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 01:02
Behavioral task
behavioral1
Sample
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
Resource
win10v2004-20240611-en
General
-
Target
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
-
Size
64KB
-
MD5
f27c858bd876a8b76099a27355ec5a8d
-
SHA1
ede4b114704aa305aa5d8a38efac970870c8830f
-
SHA256
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9
-
SHA512
e570de2b4777aeea10394bef836454242408aea2fa953e5af52da3d0e200baa560d2a3732ebc69becff7a6acc1a9d2b4a1b5c430420a6cc47a9efe278500d721
-
SSDEEP
1536:4M/kpUvIa3EVYmmd2ittWJiQYciZbzHbWf9CRkgjaCpwrkd:cUvImEVrEOiQGZrkxEBwa
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar\"" java.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 1396 wrote to memory of 3668 1396 java.exe icacls.exe PID 1396 wrote to memory of 3668 1396 java.exe icacls.exe PID 1396 wrote to memory of 372 1396 java.exe cmd.exe PID 1396 wrote to memory of 372 1396 java.exe cmd.exe PID 1396 wrote to memory of 4368 1396 java.exe java.exe PID 1396 wrote to memory of 4368 1396 java.exe java.exe PID 372 wrote to memory of 1180 372 cmd.exe schtasks.exe PID 372 wrote to memory of 1180 372 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jarFilesize
64KB
MD5f27c858bd876a8b76099a27355ec5a8d
SHA1ede4b114704aa305aa5d8a38efac970870c8830f
SHA2560a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9
SHA512e570de2b4777aeea10394bef836454242408aea2fa953e5af52da3d0e200baa560d2a3732ebc69becff7a6acc1a9d2b4a1b5c430420a6cc47a9efe278500d721
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD58f915e51c25022b85d79fff68542aeb0
SHA11d75bfc092f0b3905138edefb0c8e8f0d9f465d8
SHA25669971cad92827dea6cb0a196f4dc1bddb3b04d28c33b672e58ecb47adf7e3c07
SHA512f40e0ae1d5eccc4cd6f49735aad3d5505be3f49a77d503bb43f31c191fded4f684cb2f5ee1c0ee2d58f985947e0d8b1e40e5d0a32772e4e511beeb39e3b2f86d
-
memory/1396-26-0x0000025422840000-0x0000025422850000-memory.dmpFilesize
64KB
-
memory/1396-33-0x0000025422570000-0x00000254227E0000-memory.dmpFilesize
2.4MB
-
memory/1396-17-0x0000025422800000-0x0000025422810000-memory.dmpFilesize
64KB
-
memory/1396-19-0x0000025422810000-0x0000025422820000-memory.dmpFilesize
64KB
-
memory/1396-21-0x0000025422820000-0x0000025422830000-memory.dmpFilesize
64KB
-
memory/1396-23-0x0000025422830000-0x0000025422840000-memory.dmpFilesize
64KB
-
memory/1396-34-0x00000254227E0000-0x00000254227F0000-memory.dmpFilesize
64KB
-
memory/1396-13-0x00000254227E0000-0x00000254227F0000-memory.dmpFilesize
64KB
-
memory/1396-32-0x0000025422550000-0x0000025422551000-memory.dmpFilesize
4KB
-
memory/1396-16-0x00000254227F0000-0x0000025422800000-memory.dmpFilesize
64KB
-
memory/1396-40-0x0000025422840000-0x0000025422850000-memory.dmpFilesize
64KB
-
memory/1396-39-0x0000025422830000-0x0000025422840000-memory.dmpFilesize
64KB
-
memory/1396-2-0x0000025422570000-0x00000254227E0000-memory.dmpFilesize
2.4MB
-
memory/1396-38-0x0000025422820000-0x0000025422830000-memory.dmpFilesize
64KB
-
memory/1396-37-0x0000025422810000-0x0000025422820000-memory.dmpFilesize
64KB
-
memory/1396-36-0x0000025422800000-0x0000025422810000-memory.dmpFilesize
64KB
-
memory/1396-35-0x00000254227F0000-0x0000025422800000-memory.dmpFilesize
64KB
-
memory/4368-54-0x0000025F55B70000-0x0000025F55B80000-memory.dmpFilesize
64KB
-
memory/4368-73-0x0000025F54060000-0x0000025F54061000-memory.dmpFilesize
4KB
-
memory/4368-58-0x0000025F55B90000-0x0000025F55BA0000-memory.dmpFilesize
64KB
-
memory/4368-57-0x0000025F55B80000-0x0000025F55B90000-memory.dmpFilesize
64KB
-
memory/4368-63-0x0000025F55BB0000-0x0000025F55BC0000-memory.dmpFilesize
64KB
-
memory/4368-62-0x0000025F55BA0000-0x0000025F55BB0000-memory.dmpFilesize
64KB
-
memory/4368-65-0x0000025F55BC0000-0x0000025F55BD0000-memory.dmpFilesize
64KB
-
memory/4368-66-0x0000025F55BD0000-0x0000025F55BE0000-memory.dmpFilesize
64KB
-
memory/4368-69-0x0000025F55BE0000-0x0000025F55BF0000-memory.dmpFilesize
64KB
-
memory/4368-71-0x0000025F55BF0000-0x0000025F55C00000-memory.dmpFilesize
64KB
-
memory/4368-72-0x0000025F55C00000-0x0000025F55C10000-memory.dmpFilesize
64KB
-
memory/4368-44-0x0000025F55900000-0x0000025F55B70000-memory.dmpFilesize
2.4MB
-
memory/4368-75-0x0000025F55900000-0x0000025F55B70000-memory.dmpFilesize
2.4MB
-
memory/4368-77-0x0000025F55B70000-0x0000025F55B80000-memory.dmpFilesize
64KB
-
memory/4368-78-0x0000025F55B80000-0x0000025F55B90000-memory.dmpFilesize
64KB
-
memory/4368-79-0x0000025F55B90000-0x0000025F55BA0000-memory.dmpFilesize
64KB
-
memory/4368-80-0x0000025F55BA0000-0x0000025F55BB0000-memory.dmpFilesize
64KB
-
memory/4368-81-0x0000025F55BB0000-0x0000025F55BC0000-memory.dmpFilesize
64KB
-
memory/4368-83-0x0000025F55BD0000-0x0000025F55BE0000-memory.dmpFilesize
64KB
-
memory/4368-82-0x0000025F55BC0000-0x0000025F55BD0000-memory.dmpFilesize
64KB
-
memory/4368-84-0x0000025F55BE0000-0x0000025F55BF0000-memory.dmpFilesize
64KB
-
memory/4368-85-0x0000025F55BF0000-0x0000025F55C00000-memory.dmpFilesize
64KB