Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 03:21
Behavioral task
behavioral1
Sample
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
Resource
win10v2004-20240508-en
General
-
Target
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar
-
Size
64KB
-
MD5
f27c858bd876a8b76099a27355ec5a8d
-
SHA1
ede4b114704aa305aa5d8a38efac970870c8830f
-
SHA256
0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9
-
SHA512
e570de2b4777aeea10394bef836454242408aea2fa953e5af52da3d0e200baa560d2a3732ebc69becff7a6acc1a9d2b4a1b5c430420a6cc47a9efe278500d721
-
SSDEEP
1536:4M/kpUvIa3EVYmmd2ittWJiQYciZbzHbWf9CRkgjaCpwrkd:cUvImEVrEOiQGZrkxEBwa
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
java.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar java.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
java.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar\"" java.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9 = "\"C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar\"" java.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 1212 wrote to memory of 5000 1212 java.exe icacls.exe PID 1212 wrote to memory of 5000 1212 java.exe icacls.exe PID 1212 wrote to memory of 4708 1212 java.exe cmd.exe PID 1212 wrote to memory of 4708 1212 java.exe cmd.exe PID 1212 wrote to memory of 2792 1212 java.exe java.exe PID 1212 wrote to memory of 2792 1212 java.exe java.exe PID 4708 wrote to memory of 872 4708 cmd.exe schtasks.exe PID 4708 wrote to memory of 872 4708 cmd.exe schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\cmd.execmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jar"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\0a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9.jarFilesize
64KB
MD5f27c858bd876a8b76099a27355ec5a8d
SHA1ede4b114704aa305aa5d8a38efac970870c8830f
SHA2560a830444a8c87e98ea93f7e726ecf1aa22aa07799bf6d374edc2c5dfdde511f9
SHA512e570de2b4777aeea10394bef836454242408aea2fa953e5af52da3d0e200baa560d2a3732ebc69becff7a6acc1a9d2b4a1b5c430420a6cc47a9efe278500d721
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5b23282d986c4ad99f97cc9b47005f0a9
SHA16be91b83294c2a76d7a5fc68fd186846a13f4e94
SHA2568553a86361fec8c063caefe7e772c6cfdf6b5d0f1fda00029badc2476f477ab6
SHA5129bb7c871188ee984d6926980b20e3974c7df8406fa0c317c891fb72079ff42b22f6be6e5f0d56060c90b3e391dc04299344510bc1ca9b9175db1c5a0b76e8c56
-
memory/1212-37-0x000002A9EAE90000-0x000002A9EAEA0000-memory.dmpFilesize
64KB
-
memory/1212-15-0x000002A9EAE90000-0x000002A9EAEA0000-memory.dmpFilesize
64KB
-
memory/1212-17-0x000002A9EAEA0000-0x000002A9EAEB0000-memory.dmpFilesize
64KB
-
memory/1212-23-0x000002A9EAED0000-0x000002A9EAEE0000-memory.dmpFilesize
64KB
-
memory/1212-22-0x000002A9EAEC0000-0x000002A9EAED0000-memory.dmpFilesize
64KB
-
memory/1212-21-0x000002A9EAEB0000-0x000002A9EAEC0000-memory.dmpFilesize
64KB
-
memory/1212-2-0x000002A9EAC10000-0x000002A9EAE80000-memory.dmpFilesize
2.4MB
-
memory/1212-28-0x000002A9EAEF0000-0x000002A9EAF00000-memory.dmpFilesize
64KB
-
memory/1212-14-0x000002A9EAE80000-0x000002A9EAE90000-memory.dmpFilesize
64KB
-
memory/1212-35-0x000002A9EAF00000-0x000002A9EAF10000-memory.dmpFilesize
64KB
-
memory/1212-36-0x000002A9E9340000-0x000002A9E9341000-memory.dmpFilesize
4KB
-
memory/1212-39-0x000002A9EAC10000-0x000002A9EAE80000-memory.dmpFilesize
2.4MB
-
memory/1212-44-0x000002A9EAEE0000-0x000002A9EAEF0000-memory.dmpFilesize
64KB
-
memory/1212-43-0x000002A9EAED0000-0x000002A9EAEE0000-memory.dmpFilesize
64KB
-
memory/1212-42-0x000002A9EAEC0000-0x000002A9EAED0000-memory.dmpFilesize
64KB
-
memory/1212-41-0x000002A9EAEB0000-0x000002A9EAEC0000-memory.dmpFilesize
64KB
-
memory/1212-40-0x000002A9EAEA0000-0x000002A9EAEB0000-memory.dmpFilesize
64KB
-
memory/1212-38-0x000002A9EAE80000-0x000002A9EAE90000-memory.dmpFilesize
64KB
-
memory/1212-26-0x000002A9EAEE0000-0x000002A9EAEF0000-memory.dmpFilesize
64KB
-
memory/2792-82-0x000002BC2CF60000-0x000002BC2CF70000-memory.dmpFilesize
64KB
-
memory/2792-77-0x000002BC2CCB0000-0x000002BC2CF20000-memory.dmpFilesize
2.4MB
-
memory/2792-59-0x000002BC2CF20000-0x000002BC2CF30000-memory.dmpFilesize
64KB
-
memory/2792-62-0x000002BC2CF40000-0x000002BC2CF50000-memory.dmpFilesize
64KB
-
memory/2792-66-0x000002BC2CF60000-0x000002BC2CF70000-memory.dmpFilesize
64KB
-
memory/2792-65-0x000002BC2CF50000-0x000002BC2CF60000-memory.dmpFilesize
64KB
-
memory/2792-69-0x000002BC2CF70000-0x000002BC2CF80000-memory.dmpFilesize
64KB
-
memory/2792-71-0x000002BC2CF80000-0x000002BC2CF90000-memory.dmpFilesize
64KB
-
memory/2792-73-0x000002BC2CF90000-0x000002BC2CFA0000-memory.dmpFilesize
64KB
-
memory/2792-74-0x000002BC2CFA0000-0x000002BC2CFB0000-memory.dmpFilesize
64KB
-
memory/2792-75-0x000002BC2CC90000-0x000002BC2CC91000-memory.dmpFilesize
4KB
-
memory/2792-60-0x000002BC2CF30000-0x000002BC2CF40000-memory.dmpFilesize
64KB
-
memory/2792-78-0x000002BC2CF20000-0x000002BC2CF30000-memory.dmpFilesize
64KB
-
memory/2792-79-0x000002BC2CF30000-0x000002BC2CF40000-memory.dmpFilesize
64KB
-
memory/2792-80-0x000002BC2CF40000-0x000002BC2CF50000-memory.dmpFilesize
64KB
-
memory/2792-48-0x000002BC2CCB0000-0x000002BC2CF20000-memory.dmpFilesize
2.4MB
-
memory/2792-81-0x000002BC2CF50000-0x000002BC2CF60000-memory.dmpFilesize
64KB
-
memory/2792-83-0x000002BC2CF70000-0x000002BC2CF80000-memory.dmpFilesize
64KB
-
memory/2792-84-0x000002BC2CF80000-0x000002BC2CF90000-memory.dmpFilesize
64KB
-
memory/2792-85-0x000002BC2CF90000-0x000002BC2CFA0000-memory.dmpFilesize
64KB
-
memory/2792-86-0x000002BC2CFA0000-0x000002BC2CFB0000-memory.dmpFilesize
64KB