Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 18:26
Behavioral task
behavioral1
Sample
skibidi.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
skibidi.jar
Resource
win10v2004-20240508-en
General
-
Target
skibidi.jar
-
Size
639KB
-
MD5
18fb0048c61f9d51f63f5c151d7db25b
-
SHA1
4a1960c5f7f024ec7ce7bab497ac8208548a5966
-
SHA256
ddf2c53942e1a9816bac0b9969a068d001497304871c4ac4943fc388957a70d1
-
SHA512
c6f1220291f7362d9eba2813add172f51c5eec6bf5dcd84ff745dfa30526c073447da57e9552b81084eb32d419e6b0130cf90fc19d607d36fcb9c68fac278f1c
-
SSDEEP
12288:vjx4QW/qICNI34Dgw8Hzgs/xRv+9mmNiRTgQReRUd3qus2JQSVrD03:vj2QayNw4cXzgsTeXiR0yHquRJrVrD03
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1719858414445.tmp" reg.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
taskmgr.exepid process 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 3320 taskmgr.exe Token: SeSystemProfilePrivilege 3320 taskmgr.exe Token: SeCreateGlobalPrivilege 3320 taskmgr.exe Token: 33 3320 taskmgr.exe Token: SeIncBasePriorityPrivilege 3320 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
taskmgr.exepid process 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
Processes:
taskmgr.exepid process 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
java.exepid process 2492 java.exe 2492 java.exe 2492 java.exe 2492 java.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
java.execmd.exedescription pid process target process PID 2492 wrote to memory of 4976 2492 java.exe icacls.exe PID 2492 wrote to memory of 4976 2492 java.exe icacls.exe PID 2492 wrote to memory of 2196 2492 java.exe attrib.exe PID 2492 wrote to memory of 2196 2492 java.exe attrib.exe PID 2492 wrote to memory of 2652 2492 java.exe cmd.exe PID 2492 wrote to memory of 2652 2492 java.exe cmd.exe PID 2652 wrote to memory of 3860 2652 cmd.exe reg.exe PID 2652 wrote to memory of 3860 2652 cmd.exe reg.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\skibidi.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719858414445.tmp2⤵
- Views/modifies file attributes
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719858414445.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719858414445.tmp" /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5949766852e40d0d36a8d7884cce767db
SHA1bbc1dd4e38d5465b91031656d858d233e7449dd0
SHA2566bf5ca58f2b22f5ec78ef17f87d4aecb75dfe46ddd64d5fc16bdad9e79cd73c1
SHA51284c6aa64eabba1c5c35f29716d8fb17cc416dc7de1cfc640d4107c1e06cfae6a28f9fa1de4d3eccbcb8ab5e2e8808b195ad81084b085e859a5e89df751a4a1c3
-
C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719858414445.tmpFilesize
639KB
MD518fb0048c61f9d51f63f5c151d7db25b
SHA14a1960c5f7f024ec7ce7bab497ac8208548a5966
SHA256ddf2c53942e1a9816bac0b9969a068d001497304871c4ac4943fc388957a70d1
SHA512c6f1220291f7362d9eba2813add172f51c5eec6bf5dcd84ff745dfa30526c073447da57e9552b81084eb32d419e6b0130cf90fc19d607d36fcb9c68fac278f1c
-
memory/2492-72-0x00000257269E0000-0x00000257269F0000-memory.dmpFilesize
64KB
-
memory/2492-44-0x0000025726990000-0x00000257269A0000-memory.dmpFilesize
64KB
-
memory/2492-18-0x0000025726900000-0x0000025726910000-memory.dmpFilesize
64KB
-
memory/2492-22-0x0000025726920000-0x0000025726930000-memory.dmpFilesize
64KB
-
memory/2492-21-0x0000025726910000-0x0000025726920000-memory.dmpFilesize
64KB
-
memory/2492-24-0x0000025726930000-0x0000025726940000-memory.dmpFilesize
64KB
-
memory/2492-26-0x0000025726940000-0x0000025726950000-memory.dmpFilesize
64KB
-
memory/2492-28-0x0000025726950000-0x0000025726960000-memory.dmpFilesize
64KB
-
memory/2492-33-0x0000025726960000-0x0000025726970000-memory.dmpFilesize
64KB
-
memory/2492-37-0x0000025724DE0000-0x0000025724DE1000-memory.dmpFilesize
4KB
-
memory/2492-38-0x0000025726970000-0x0000025726980000-memory.dmpFilesize
64KB
-
memory/2492-40-0x0000025726980000-0x0000025726990000-memory.dmpFilesize
64KB
-
memory/2492-43-0x0000025726680000-0x00000257268F0000-memory.dmpFilesize
2.4MB
-
memory/2492-75-0x00000257269F0000-0x0000025726A00000-memory.dmpFilesize
64KB
-
memory/2492-47-0x00000257268F0000-0x0000025726900000-memory.dmpFilesize
64KB
-
memory/2492-48-0x00000257269A0000-0x00000257269B0000-memory.dmpFilesize
64KB
-
memory/2492-50-0x0000025726900000-0x0000025726910000-memory.dmpFilesize
64KB
-
memory/2492-51-0x00000257269B0000-0x00000257269C0000-memory.dmpFilesize
64KB
-
memory/2492-56-0x00000257269C0000-0x00000257269D0000-memory.dmpFilesize
64KB
-
memory/2492-55-0x0000025726920000-0x0000025726930000-memory.dmpFilesize
64KB
-
memory/2492-54-0x0000025726910000-0x0000025726920000-memory.dmpFilesize
64KB
-
memory/2492-57-0x0000025724DE0000-0x0000025724DE1000-memory.dmpFilesize
4KB
-
memory/2492-58-0x0000025726930000-0x0000025726940000-memory.dmpFilesize
64KB
-
memory/2492-60-0x0000025726940000-0x0000025726950000-memory.dmpFilesize
64KB
-
memory/2492-61-0x0000025726950000-0x0000025726960000-memory.dmpFilesize
64KB
-
memory/2492-63-0x0000025726960000-0x0000025726970000-memory.dmpFilesize
64KB
-
memory/2492-66-0x0000025726970000-0x0000025726980000-memory.dmpFilesize
64KB
-
memory/2492-67-0x00000257269D0000-0x00000257269E0000-memory.dmpFilesize
64KB
-
memory/2492-68-0x0000025724DE0000-0x0000025724DE1000-memory.dmpFilesize
4KB
-
memory/2492-71-0x0000025726980000-0x0000025726990000-memory.dmpFilesize
64KB
-
memory/2492-2-0x0000025726680000-0x00000257268F0000-memory.dmpFilesize
2.4MB
-
memory/2492-74-0x0000025726990000-0x00000257269A0000-memory.dmpFilesize
64KB
-
memory/2492-16-0x00000257268F0000-0x0000025726900000-memory.dmpFilesize
64KB
-
memory/2492-78-0x00000257269A0000-0x00000257269B0000-memory.dmpFilesize
64KB
-
memory/2492-79-0x0000025726A00000-0x0000025726A10000-memory.dmpFilesize
64KB
-
memory/2492-81-0x00000257269B0000-0x00000257269C0000-memory.dmpFilesize
64KB
-
memory/2492-82-0x0000025726A10000-0x0000025726A20000-memory.dmpFilesize
64KB
-
memory/2492-85-0x00000257269C0000-0x00000257269D0000-memory.dmpFilesize
64KB
-
memory/2492-86-0x0000025726A20000-0x0000025726A30000-memory.dmpFilesize
64KB
-
memory/2492-88-0x0000025726A30000-0x0000025726A40000-memory.dmpFilesize
64KB
-
memory/2492-91-0x0000025726A40000-0x0000025726A50000-memory.dmpFilesize
64KB
-
memory/2492-94-0x0000025726A50000-0x0000025726A60000-memory.dmpFilesize
64KB
-
memory/2492-95-0x0000025724DE0000-0x0000025724DE1000-memory.dmpFilesize
4KB
-
memory/2492-96-0x00000257269D0000-0x00000257269E0000-memory.dmpFilesize
64KB
-
memory/2492-97-0x00000257269E0000-0x00000257269F0000-memory.dmpFilesize
64KB
-
memory/2492-98-0x00000257269F0000-0x0000025726A00000-memory.dmpFilesize
64KB
-
memory/2492-99-0x0000025726A00000-0x0000025726A10000-memory.dmpFilesize
64KB
-
memory/2492-100-0x0000025726A10000-0x0000025726A20000-memory.dmpFilesize
64KB
-
memory/2492-101-0x0000025726A20000-0x0000025726A30000-memory.dmpFilesize
64KB
-
memory/2492-115-0x0000025726A30000-0x0000025726A40000-memory.dmpFilesize
64KB
-
memory/2492-116-0x0000025726A40000-0x0000025726A50000-memory.dmpFilesize
64KB
-
memory/2492-117-0x0000025726A50000-0x0000025726A60000-memory.dmpFilesize
64KB
-
memory/2492-118-0x0000025724DE0000-0x0000025724DE1000-memory.dmpFilesize
4KB
-
memory/3320-103-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-104-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-108-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-114-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-113-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-112-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-102-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-111-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-110-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB
-
memory/3320-109-0x000002ADDB1F0000-0x000002ADDB1F1000-memory.dmpFilesize
4KB