Play interactive tour

Edit tour

Analysis Report invoice.jnlp

Overview

General Information

Sample Name:	invoice.jnlp
Analysis ID:	361228
MD5:	67e9e29dde633fc31d03a9075c53788d
SHA1:	e3249b46e76b3d94b46d45a38e175ef80b7d0526
SHA256:	91c8702137880cebf55f89e1d0b07df0c7c05b277850879384fa1dfe7470006c
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected JAVA Downloader Generic

Creates a process in suspended mode (likely to inject code)

Tries to load missing DLLs

Classification

Startup

System is w10x64

jp2launcher.exe (PID: 6792 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe' -securejws 'C:\Users\user\Desktop\invoice.jnlp' MD5: BA7B1294CAB259452105704FA6C6863E)

javaws.exe (PID: 6828 cmdline: 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe' 'C:\Users\user\Desktop\invoice.jnlp' MD5: F64595565AB90F21992D5964BE538A1B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
invoice.jnlp	JoeSecurity_JAVADownloaderGeneric	Yara detected JAVA Downloader Generic	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\MSVCR100.dll

Jump to behavior

Spreading:

Yara detected JAVA Downloader Generic

Show sources

Source: Yara match

File source: invoice.jnlp, type: SAMPLE

Networking:

Source: invoice.jnlp

String found in binary or memory: http://invoicesecure.net/documents

System Summary:

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	Section loaded: sfc.dll			Jump to behavior

Source: classification engine

Classification label: mal48.spre.winJNLP@3/0@0/0

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe' -securejws 'C:\Users\user\Desktop\invoice.jnlp'
Source: unknown	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe' 'C:\Users\user\Desktop\invoice.jnlp'
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe' 'C:\Users\user\Desktop\invoice.jnlp'	Jump to behavior

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\MSVCR100.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Program Files (x86)\Java\jre1.8.0_211\bin\jp2launcher.exe

Process created: C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe 'C:\Program Files (x86)\Java\jre1.8.0_211\bin\javaws.exe' 'C:\Users\user\Desktop\invoice.jnlp'

Jump to behavior

Source: jp2launcher.exe, 00000002.00000002.591775696.0000000000FB0000.00000002.00000001.sdmp, javaws.exe, 00000003.00000002.591872141.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: jp2launcher.exe, 00000002.00000002.591775696.0000000000FB0000.00000002.00000001.sdmp, javaws.exe, 00000003.00000002.591872141.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: jp2launcher.exe, 00000002.00000002.591775696.0000000000FB0000.00000002.00000001.sdmp, javaws.exe, 00000003.00000002.591872141.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: jp2launcher.exe, 00000002.00000002.591775696.0000000000FB0000.00000002.00000001.sdmp, javaws.exe, 00000003.00000002.591872141.00000000012A0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection12	Process Injection12	OS Credential Dumping	Process Discovery2	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	DLL Side-Loading1	LSASS Memory	System Information Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report invoice.jnlp

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

Compliance:

Spreading:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails