IOC Report
Tax_Documents_PDF.jar

loading gif

Files

File Path
Type
Category
Malicious
Tax_Documents_PDF.jar
Zip archive data, at least v2.0 to extract, compression method=deflate
initial sample
 malicious
C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
 malicious
C:\cmdlinestart.log
ASCII text, with CRLF, LF line terminators
dropped
 malicious
C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\hsperfdata_user\5780
data
dropped
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7588
data
dropped
C:\Users\user\AppData\Local\Temp\hsperfdata_user\7892
data
dropped
C:\Users\user\AppData\Local\Temp\m17387051107872017907981161292762.tmp
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\83aa4cc77f591dfc2374580bbd95f6ba_9e146be9-c76a-4720-bcdb-53011b87bd06
data
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Tax_Documents_PDF.jar"" >> C:\cmdlinestart.log 2>&1
malicious
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe
"C:\Program Files (x86)\Java\jre-1.8\bin\java.exe" -javaagent:"C:\Users\user~1\AppData\Local\Temp\jartracer.jar" -jar "C:\Users\user\Desktop\Tax_Documents_PDF.jar"
malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f"
malicious
C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f
malicious
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f"
malicious
C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f
malicious
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f"
malicious
C:\Windows\SysWOW64\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe -jar C:\Users\user\AppData\Roaming\Microsoft\.tmp\1738705111069.tmp" /f
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://java.oracle.com/
unknown
http://null.oracle.com/
unknown
http://www.allatori.com
unknown
http://bugreport.sun.com/bugreport/
unknown

IPs

IP
Domain
Country
Malicious
45.134.225.90
unknown
Germany
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Home
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
159DD000
heap
page read and write
 malicious
158B7000
heap
page read and write
 malicious
A265000
trusted library allocation
page read and write
 malicious
16B10000
heap
page read and write
 malicious
1589F000
heap
page read and write
 malicious
16BAC000
heap
page read and write
 malicious
A5F8000
trusted library allocation
page read and write
 malicious
15A1F000
heap
page read and write
 malicious
15828000
heap
page read and write
 malicious
15A14000
heap
page read and write
 malicious
1114000
heap
page read and write
 malicious
158C6000
heap
page read and write
 malicious
A465000
trusted library allocation
page read and write
 malicious
13C3000
heap
page read and write
 malicious
15A0D000
heap
page read and write
 malicious
16C3A000
heap
page read and write
 malicious