Analysis Report Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar

Overview

General Information

Sample Name: Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar
Analysis ID: 356987
MD5: 5435ec679cdd07fe6f4fc6f49a117ea8
SHA1: eab4494e7db4bcbebf9dc5c0197ce0081a6dda6e
SHA256: 5a962977909fafba0a1c202306068bd5f8297335b16989a07c1f119302155c84
Infos:

Most interesting Screenshot:

Detection

STRRAT
Score: 80
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected STRRAT
Connects to a pastebin service (likely for C&C)
Creates autostart registry keys to launch java
Creates multiple autostart registry keys
Exploit detected, runtime environment dropped PE file
Exploit detected, runtime environment starts unknown processes
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Allatori_JAR_Obfuscator
Contains capabilities to detect virtual machines
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Found WSH timer for Javascript or VBS script (likely evasive script)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the installed Java version
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Compliance:

barindex
Uses new MSVCR Dlls
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.154:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.3:49728 version: TLS 1.2

Software Vulnerabilities:

barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior

Networking:

barindex
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: pastebin.com
Uses dynamic DNS services
Source: unknown DNS query: name: pluginserver.duckdns.org
Source: unknown DNS query: name: strizzz100.duckdns.org
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49725 -> 107.175.144.243:4040
Source: global traffic TCP traffic: 192.168.2.3:49729 -> 23.239.31.129:54557
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.239.31.129 23.239.31.129
Source: Joe Sandbox View IP Address: 199.232.192.209 199.232.192.209
Source: Joe Sandbox View IP Address: 140.82.121.3 140.82.121.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: d2935c58fe676744fecc8614ee5356c7
Source: unknown DNS traffic detected: queries for: github.com
Source: java.exe, 00000008.00000002.240115149.0000000005254000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.478504835.000000000A598000.00000004.00000001.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt3
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt9
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt90
Source: javaw.exe, 00000007.00000002.230179968.0000000005274000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crtS
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crts
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230572094.000000000534F000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
Source: javaw.exe, 00000007.00000002.230503075.0000000005309000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp String found in binary or memory: http://crl.chambersign.org/chambersroot.crlK%
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240908433.000000000A926000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240908433.000000000A926000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240908433.000000000A926000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl
Source: javaw.exe, 00000007.00000002.230211483.0000000005287000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl#
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl90
Source: javaw.exe, 00000007.00000002.231223812.000000000A64E000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl
Source: javaw.exe, 00000007.00000002.231223812.000000000A64E000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230211483.0000000005287000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl9
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crlfferent
Source: javaw.exe, 00000007.00000002.231223812.000000000A64E000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230572094.000000000534F000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl
Source: javaw.exe, 00000007.00000002.230503075.0000000005309000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: java.exe, 00000003.00000002.199757814.0000000004B32000.00000004.00000001.sdmp, java.exe, 00000003.00000002.199851526.0000000009BD5000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230632591.000000000A3A2000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240115149.0000000005254000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.478598950.000000000A5A1000.00000004.00000001.sdmp String found in binary or memory: http://java.oracle.com/
Source: java.exe, 0000000B.00000002.472694359.00000000051AA000.00000004.00000001.sdmp String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Source: java.exe String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0F
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0K
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0M
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com90
Source: javaw.exe, 00000007.00000002.230179968.0000000005274000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.comS
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.coms
Source: wscript.exe, 00000006.00000003.204854343.000000000548C000.00000004.00000001.sdmp String found in binary or memory: http://ops.com.pa/jre7.zip
Source: wscript.exe, 00000006.00000003.207608361.00000000061F0000.00000004.00000001.sdmp String found in binary or memory: http://ops.com.pa/jre7.zipnf
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://policy.camerfirma.com
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://repository.swisssign.com/0
Source: java.exe, 0000000B.00000002.475250989.00000000053CA000.00000004.00000001.sdmp String found in binary or memory: http://str-master.pw
Source: java.exe, 0000000B.00000002.475200533.00000000053C1000.00000004.00000001.sdmp String found in binary or memory: http://str-master.pw/strigoi/server/ping.php
Source: java.exe, 0000000B.00000002.475250989.00000000053CA000.00000004.00000001.sdmp String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?
Source: java.exe, 0000000B.00000002.475200533.00000000053C1000.00000004.00000001.sdmp String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?lid=
Source: java.exe, 0000000B.00000002.475250989.00000000053CA000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.475200533.00000000053C1000.00000004.00000001.sdmp String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?lid=RUGR-ATSN-D14P-VBXX-49LW
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: javaw.exe, 00000007.00000002.230591347.000000000A36E000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240669616.000000000A76C000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.478558218.000000000A59F000.00000004.00000001.sdmp String found in binary or memory: http://www.allatori.com
Source: javaw.exe, 00000007.00000002.231305715.000000000A6CC000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/
Source: java.exe String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: java.exe, 00000008.00000003.236877886.00000000157D7000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.485142565.00000000156D4000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: javaw.exe, 00000007.00000002.231305715.000000000A6CC000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240908433.000000000A926000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.chambersign.org
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.chambersign.org1
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240908433.000000000A926000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231305715.000000000A6CC000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: https://api.github.com/_private/browser/errors
Source: javaw.exe, 00000007.00000002.231305715.000000000A6CC000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.231252298.000000000A675000.00000004.00000001.sdmp String found in binary or memory: https://github-releases.githubusercontent.com/51361554/623ef000-9da4-11e9-9ea2-d90155318994?X-Amz-Al
Source: javaw.exe, 00000007.00000002.230576050.000000000A350000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240655876.000000000A750000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.477826365.000000000A550000.00000004.00000001.sdmp String found in binary or memory: https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
Source: java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: javaw.exe, 00000007.00000002.231004788.000000000A525000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240603827.00000000056CD000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.479989081.000000000A72A000.00000004.00000001.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 00000007.00000002.230576050.000000000A350000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240655876.000000000A750000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.477826365.000000000A550000.00000004.00000001.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
Source: javaw.exe, 00000007.00000002.230591347.000000000A36E000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230576050.000000000A350000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240655876.000000000A750000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.477826365.000000000A550000.00000004.00000001.sdmp String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
Source: javaw.exe, 00000007.00000002.224848171.0000000004EF8000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.230576050.000000000A350000.00000004.00000001.sdmp, java.exe, 00000008.00000002.240655876.000000000A750000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.477826365.000000000A550000.00000004.00000001.sdmp String found in binary or memory: https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
Source: javaw.exe, 00000007.00000002.231546296.000000000A723000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPS
Source: javaw.exe, 00000007.00000002.231505878.000000000A717000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPS0
Source: javaw.exe, 00000007.00000002.230154394.0000000005268000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPS9
Source: javaw.exe, 00000007.00000002.230179968.0000000005274000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPSS
Source: javaw.exe, 00000007.00000002.230443511.00000000052E4000.00000004.00000001.sdmp String found in binary or memory: https://www.digicert.com/CPSs
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.154:443 -> 192.168.2.3:49714 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.23.98.190:443 -> 192.168.2.3:49728 version: TLS 1.2

System Summary:

barindex
Detected potential crypto function
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_026533EB 3_2_026533EB
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_0264E857 3_2_0264E857
Yara signature match
Source: 00000003.00000002.202961213.00000000151A2000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: java.exe PID: 5408, type: MEMORY Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: C:\Users\user\fukvowbkrs.js, type: DROPPED Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: classification engine Classification label: mal80.troj.expl.evad.winJAR@33/27@14/7
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\fukvowbkrs.js Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2308:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4860:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5544:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4912:120:WilError_01
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Section loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: java.exe String found in binary or memory: k.in-addr.arpa
Source: java.exe String found in binary or memory: /Addr0@20
Source: java.exe String found in binary or memory: -Adding paths from jna.library.path:
Source: java.exe String found in binary or memory: /Addr0@20
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'' >> C:\cmdlinestart.log 2>&1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Source: unknown Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt'
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\pruoglcim.txt'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt'
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt'
Source: unknown Process created: C:\Windows\System32\notepad.exe C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\pruoglcim.txt
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\pruoglcim.txt
Source: unknown Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32 Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior

Data Obfuscation:

barindex
Yara detected Allatori_JAR_Obfuscator
Source: Yara match File source: 00000017.00000002.277589496.0000000004E65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.384777026.0000000004E65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.478558218.000000000A59F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.277508608.0000000004E1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.384680403.0000000004E10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.478070245.000000000A56D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.312715273.0000000004C1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.312696044.0000000004C10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.478189359.000000000A1A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.384694619.0000000004E1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240669616.000000000A76C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000002.312890615.0000000004C65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.478011321.000000000A16E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.230591347.000000000A36E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.277495172.0000000004E10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240700127.000000000A79E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.230627136.000000000A3A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: javaw.exe PID: 4812, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 6120, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025AB377 push 00000000h; mov dword ptr [esp], esp 3_2_025AB39D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025ABB27 push 00000000h; mov dword ptr [esp], esp 3_2_025ABB4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025AB907 push 00000000h; mov dword ptr [esp], esp 3_2_025AB92D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025AA1DB push ecx; ret 3_2_025AA1E5
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025AA1CA push ecx; ret 3_2_025AA1DA
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025AC437 push 00000000h; mov dword ptr [esp], esp 3_2_025AC45D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025B2D44 push eax; retf 3_2_025B2D45
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_02649791 push cs; retf 3_2_026497B1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A4CB43 push eax; iretd 7_3_15A4CB59
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CF34 pushad ; iretd 7_3_15A0CF3D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CB12 push eax; retf 7_3_15A0CB2D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CB44 push eax; retf 7_3_15A0CB45
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CF4B pushad ; iretd 7_3_15A0CF55
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CF34 pushad ; iretd 7_3_15A0CF3D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CB12 push eax; retf 7_3_15A0CB2D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CB44 push eax; retf 7_3_15A0CB45
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 7_3_15A0CF4B pushad ; iretd 7_3_15A0CF55
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DEA8D8 pushad ; ret 8_3_15DEA92D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DE3948 pushad ; iretd 8_3_15DE3CB1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DEAC73 push eax; retf 8_3_15DEAC79
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DEA8D8 pushad ; ret 8_3_15DEA92D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DE3948 pushad ; iretd 8_3_15DE3CB1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_15DEAC73 push eax; retf 8_3_15DEAC79
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_157CC3EF push esp; ret 8_3_157CC3F1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 8_3_157CCEAA push dword ptr [edi]; retf 8_3_157CCEB1
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 11_3_156DA9BD push ds; retf 11_3_156DA9BE
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 17_3_152476C5 push ds; retf 17_3_152476C6
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 17_3_158E0C90 push cs; retf 0071h 17_3_158E0C92
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 23_2_02B9BB27 push 00000000h; mov dword ptr [esp], esp 23_2_02B9BB4D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 23_2_02B9B377 push 00000000h; mov dword ptr [esp], esp 23_2_02B9B39D
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Code function: 23_2_02B9A1DB push ecx; ret 23_2_02B9A1E5

Persistence and Installation Behavior:

barindex
Exploit detected, runtime environment dropped PE file
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: jna822539700341149381.dll.8.dr Jump to dropped file
Drops PE files
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna3285767908382047760.dll Jump to dropped file
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna822539700341149381.dll Jump to dropped file
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna552460949331173543.dll Jump to dropped file

Boot Survival:

barindex
Creates autostart registry keys to launch java
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run plugins "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\plugins.jar" mp
Creates multiple autostart registry keys
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pruoglcim Jump to behavior
Uses schtasks.exe or at.exe to add and modify task schedules
Source: unknown Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt'
Creates a start menu entry (Start Menu\Programs\Startup)
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pruoglcim Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run pruoglcim Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins

Hooking and other Techniques for Hiding and Protection:

barindex
Uses cacls to modify the permissions of files
Source: unknown Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains capabilities to detect virtual machines
Source: C:\Windows\SysWOW64\wscript.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: java.exe, 00000003.00000002.202400044.0000000014E60000.00000002.00000001.sdmp, wscript.exe, 00000006.00000002.210850058.0000000005FB0000.00000002.00000001.sdmp, javaw.exe, 00000007.00000002.234368072.0000000015900000.00000002.00000001.sdmp, java.exe, 00000008.00000002.243954592.00000000159D0000.00000002.00000001.sdmp, java.exe, 0000000B.00000002.485837825.0000000015880000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: java.exe, 00000003.00000002.198372393.00000000024A0000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.223746518.0000000002AA0000.00000004.00000001.sdmp, java.exe, 00000008.00000002.239783736.0000000002F40000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.468599260.0000000002DF0000.00000004.00000001.sdmp Binary or memory string: ,java/lang/VirtualMachineError
Source: java.exe, 00000003.00000002.198372393.00000000024A0000.00000004.00000001.sdmp, javaw.exe, 00000007.00000002.223746518.0000000002AA0000.00000004.00000001.sdmp, java.exe, 00000008.00000002.239783736.0000000002F40000.00000004.00000001.sdmp, java.exe, 0000000B.00000002.468599260.0000000002DF0000.00000004.00000001.sdmp Binary or memory string: |[Ljava/lang/VirtualMachineError;
Source: java.exe, 00000003.00000002.202400044.0000000014E60000.00000002.00000001.sdmp, wscript.exe, 00000006.00000002.210850058.0000000005FB0000.00000002.00000001.sdmp, javaw.exe, 00000007.00000002.234368072.0000000015900000.00000002.00000001.sdmp, java.exe, 00000008.00000002.243954592.00000000159D0000.00000002.00000001.sdmp, java.exe, 0000000B.00000002.485837825.0000000015880000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: java.exe, 00000003.00000002.202400044.0000000014E60000.00000002.00000001.sdmp, wscript.exe, 00000006.00000002.210850058.0000000005FB0000.00000002.00000001.sdmp, javaw.exe, 00000007.00000002.234368072.0000000015900000.00000002.00000001.sdmp, java.exe, 00000008.00000002.243954592.00000000159D0000.00000002.00000001.sdmp, java.exe, 0000000B.00000002.485837825.0000000015880000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: java.exe, 00000003.00000002.202400044.0000000014E60000.00000002.00000001.sdmp, wscript.exe, 00000006.00000002.210850058.0000000005FB0000.00000002.00000001.sdmp, javaw.exe, 00000007.00000002.234368072.0000000015900000.00000002.00000001.sdmp, java.exe, 00000008.00000002.243954592.00000000159D0000.00000002.00000001.sdmp, java.exe, 0000000B.00000002.485837825.0000000015880000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Memory protected: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\pruoglcim.txt' Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -javaagent:'C:\Users\user\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'' >> C:\cmdlinestart.log 2>&1
Source: java.exe, 0000000B.00000002.468013873.00000000017E0000.00000002.00000001.sdmp, notepad.exe, 00000010.00000002.469204644.0000024CECE50000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: java.exe, 0000000B.00000002.468013873.00000000017E0000.00000002.00000001.sdmp, notepad.exe, 00000010.00000002.469204644.0000024CECE50000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: java.exe, 0000000B.00000002.468013873.00000000017E0000.00000002.00000001.sdmp, notepad.exe, 00000010.00000002.469204644.0000024CECE50000.00000002.00000001.sdmp Binary or memory string: Progman
Source: java.exe, 0000000B.00000002.468013873.00000000017E0000.00000002.00000001.sdmp, notepad.exe, 00000010.00000002.469204644.0000024CECE50000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe Code function: 3_2_025A0380 cpuid 3_2_025A0380
Queries the installed Java version
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\pruoglcim.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\pruoglcim.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\pruoglcim.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\pruoglcim.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pruoglcim.txt VolumeInformation
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected STRRAT
Source: Yara match File source: 0000000B.00000002.475250989.00000000053CA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.476909178.000000000503D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240531758.0000000005635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240290429.00000000053D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.479562257.000000000A413000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.476979957.00000000054CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 6120, type: MEMORY

Remote Access Functionality:

barindex
Yara detected STRRAT
Source: Yara match File source: 0000000B.00000002.475250989.00000000053CA000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.476909178.000000000503D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240531758.0000000005635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.240290429.00000000053D2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.479562257.000000000A413000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.476979957.00000000054CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: java.exe PID: 6120, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 356987 Sample: Covid19_Vacine_Investment_P... Startdate: 23/02/2021 Architecture: WINDOWS Score: 80 70 strizzz100.duckdns.org 2->70 72 pluginserver.duckdns.org 2->72 94 Yara detected STRRAT 2->94 96 Connects to a pastebin service (likely for C&C) 2->96 98 Exploit detected, runtime environment dropped PE file 2->98 102 2 other signatures 2->102 13 cmd.exe 2 2->13         started        15 notepad.exe 2->15         started        17 notepad.exe 2->17         started        19 6 other processes 2->19 signatures3 100 Uses dynamic DNS services 70->100 process4 process5 21 java.exe 6 13->21         started        24 conhost.exe 13->24         started        signatures6 106 Exploit detected, runtime environment starts unknown processes 21->106 26 wscript.exe 2 21->26         started        28 icacls.exe 1 21->28         started        process7 process8 30 javaw.exe 25 26->30         started        33 conhost.exe 28->33         started        dnsIp9 78 github.com 140.82.121.3, 443, 49710 GITHUBUS United States 30->78 80 github-releases.githubusercontent.com 185.199.110.154, 443, 49714 FASTLYUS Netherlands 30->80 82 3 other IPs or domains 30->82 35 java.exe 2 21 30->35         started        process10 file11 62 C:\Users\user\AppData\Roaming\pruoglcim.txt, Zip 35->62 dropped 64 C:\Users\user\...\jna822539700341149381.dll, PE32 35->64 dropped 104 Creates multiple autostart registry keys 35->104 39 java.exe 15 35->39         started        43 cmd.exe 1 35->43         started        45 conhost.exe 35->45         started        signatures12 process13 dnsIp14 74 strizzz100.duckdns.org 107.175.144.243, 1071, 4040 AS-COLOCROSSINGUS United States 39->74 76 str-master.pw 39->76 66 C:\Users\user\AppData\Roaming\plugins.jar, Zip 39->66 dropped 68 C:\Users\user\...\jna3285767908382047760.dll, PE32 39->68 dropped 47 java.exe 39->47         started        52 conhost.exe 39->52         started        54 conhost.exe 43->54         started        56 schtasks.exe 43->56         started        file15 process16 dnsIp17 84 pluginserver.duckdns.org 23.239.31.129, 54557 LINODE-APLinodeLLCUS United States 47->84 86 str-master.pw 47->86 88 2 other IPs or domains 47->88 60 C:\Users\user\...\jna552460949331173543.dll, PE32 47->60 dropped 90 Creates autostart registry keys to launch java 47->90 92 Creates multiple autostart registry keys 47->92 58 conhost.exe 47->58         started        file18 signatures19 process20
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.239.31.129
 unknown United States
63949 LINODE-APLinodeLLCUS true
199.232.192.209
 unknown United States
54113 FASTLYUS false
140.82.121.3
 unknown United States
36459 GITHUBUS false
107.175.144.243
 unknown United States
36352 AS-COLOCROSSINGUS true
104.23.98.190
 unknown United States
13335 CLOUDFLARENETUS false
185.199.110.154
 unknown Netherlands
54113 FASTLYUS false

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
pluginserver.duckdns.org 23.239.31.129 true
sonatype.map.fastly.net 199.232.192.209 true
github.com 140.82.121.3 true
strizzz100.duckdns.org 107.175.144.243 true
github-releases.githubusercontent.com 185.199.110.154 true
pastebin.com 104.23.98.190 true
str-master.pw unknown unknown
repo1.maven.org unknown unknown
jbfrost.live unknown unknown