| File name: | 1.jar |
| Full analysis: | https://app.any.run/tasks/7aef259a-5fda-42c9-aa89-c20fd741f00a |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | October 05, 2022, 06:51:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | B4F7583051E83996AD8D24F6FE6800DB |
| SHA1: | 704CC679D91A5C1783A6C7911E2E09C70C825795 |
| SHA256: | 0BEC974068FD7804C1D4A9F08F35187655935DFAABFEB616F57CF3808A6018C6 |
| SSDEEP: | 1536:gJ/o1AzGP1M9Q+1+j/Zc82nGSNPsPjS05pLTuj6T+4mheT+RHGvtvxYpRHrj4:gJlzGP14QHjQGwPuj759TuWTtT+4v4L0 |
MALICIOUS
Loads dropped or rewritten executable
- java.exe (PID: 1368)
- java.exe (PID: 860)
Writes to the Start menu file
- java.exe (PID: 1368)
Saves itself using an automatic execution at the hidden registry location
- java.exe (PID: 1368)
StrRat is detected
- javaw.exe (PID: 3224)
Changes the autorun value in the registry
- java.exe (PID: 1368)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 3904)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 2128)
STRRAT was detected
- java.exe (PID: 860)
STRRAT detected by memory dumps
- java.exe (PID: 860)
SUSPICIOUS
Reads the machine GUID from the registry
- javaw.exe (PID: 3224)
- java.exe (PID: 1368)
- java.exe (PID: 860)
Uses ICACLS.EXE to modify the access control list
- javaw.exe (PID: 3224)
Executes JAVA applets
- javaw.exe (PID: 3224)
- java.exe (PID: 1368)
Starts CMD.EXE for commands execution
- java.exe (PID: 1368)
Application launched itself
- java.exe (PID: 1368)
INFO
Creates a file in a temporary directory
- javaw.exe (PID: 3224)
- java.exe (PID: 1368)
- java.exe (PID: 860)
Creates files in the program directory
- javaw.exe (PID: 3224)
Checks supported languages
- javaw.exe (PID: 3224)
- java.exe (PID: 1368)
- java.exe (PID: 860)
Process checks LSA protection
- java.exe (PID: 1368)
- javaw.exe (PID: 3224)
- java.exe (PID: 860)
Reads the computer name
- javaw.exe (PID: 3224)
- java.exe (PID: 1368)
- java.exe (PID: 860)
Creates files in the user directory
- java.exe (PID: 1368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
STRRAT
(PID) Process(860) java.exe
C2teewirman.ddns.net
Port1987
URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
Options
Startup Folder Persistencetrue
Secondary Startup Folder Persistencetrue
Skype Scheduled Task Persistencetrue
Proxy208.67.105.233
LIDkhonsa
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
Total processes
41
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 860 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\AppData\Roaming\1.jar" | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | java.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
STRRAT(PID) Process(860) java.exe C2teewirman.ddns.net Port1987 URLhttp://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5 Options Startup Folder Persistencetrue Secondary Startup Folder Persistencetrue Skype Scheduled Task Persistencetrue Proxy208.67.105.233 LIDkhonsa | |||||||||||||||
| 1368 | "C:\Program Files\Java\jre1.8.0_271\bin\java.exe" -jar "C:\Users\admin\1.jar" | C:\Program Files\Java\jre1.8.0_271\bin\java.exe | javaw.exe | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 1464 | C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M | C:\Windows\system32\icacls.exe | — | javaw.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2128 | schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\1.jar" | C:\Windows\system32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3224 | "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\1.jar" | C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe | Explorer.EXE | ||||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.2710.9 Modules
| |||||||||||||||
| 3904 | cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\1.jar" | C:\Windows\system32\cmd.exe | — | java.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
2 070
Read events
2 069
Write events
1
Delete events
0
Modification events
| (PID) Process: | (1368) java.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | 1 |
Value: "C:\Program Files\Java\jre1.8.0_271\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\1.jar" | |||
Executable files
8
Suspicious files
9
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3224 | javaw.exe | C:\ProgramData\Oracle\Java\.oracle_jre_usage\17dfc292991c8061.timestamp | text | |
MD5:— | SHA256:— | |||
| 3224 | javaw.exe | C:\Users\admin\1.jar | compressed | |
MD5:— | SHA256:— | |||
| 1368 | java.exe | C:\Users\admin\AppData\Roaming\1.jar | compressed | |
MD5:— | SHA256:— | |||
| 3224 | javaw.exe | C:\Users\admin\lib\sqlite-jdbc-3.14.2.1.jar | compressed | |
MD5:B33387E15AB150A7BF560ABDC73C3BEC | SHA256:2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491 | |||
| 1368 | java.exe | C:\Users\admin\AppData\Local\Temp\jna-92668751\jna6344915052279104889.dll | executable | |
MD5:28D895A3CB7E9A0B6A5AE5ED6A62B254 | SHA256:04C9A8AB43D1EB616B84D0686C8AE1D881EF03FE4F3AA26511E5B19D35EF16AF | |||
| 3224 | javaw.exe | C:\Users\admin\lib\jna-5.5.0.jar | java | |
MD5:ACFB5B5FD9EE10BF69497792FD469F85 | SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E | |||
| 3224 | javaw.exe | C:\Users\admin\lib\jna-platform-5.5.0.jard | java | |
MD5:2F4A99C2758E72EE2B59A73586A2322F | SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5 | |||
| 860 | java.exe | C:\Users\admin\AppData\Local\Temp\jna-92668751\jna9045305100604512464.dll | executable | |
MD5:28D895A3CB7E9A0B6A5AE5ED6A62B254 | SHA256:04C9A8AB43D1EB616B84D0686C8AE1D881EF03FE4F3AA26511E5B19D35EF16AF | |||
| 3224 | javaw.exe | C:\Users\admin\lib\sqlite-jdbc-3.14.2.1.jard | compressed | |
MD5:B33387E15AB150A7BF560ABDC73C3BEC | SHA256:2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491 | |||
| 1368 | java.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1.jar | compressed | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
12
DNS requests
7
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
860 | java.exe | GET | 404 | 142.93.110.250:80 | http://str-master.pw/strigoi/server/ping.php?lid=khonsari | CA | html | 178 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
860 | java.exe | 142.93.110.250:80 | str-master.pw | DIGITALOCEAN-ASN | DE | malicious |
3224 | javaw.exe | 151.101.112.209:443 | repo1.maven.org | FASTLY | DE | suspicious |
3224 | javaw.exe | 185.199.110.133:443 | objects.githubusercontent.com | FASTLY | US | malicious |
860 | java.exe | 208.67.105.233:1981 | — | Delis LLC | US | unknown |
3224 | javaw.exe | 140.82.121.4:443 | github.com | GITHUB | US | malicious |
3224 | javaw.exe | 199.232.192.209:443 | repo1.maven.org | FASTLY | US | suspicious |
— | — | 151.101.112.209:443 | repo1.maven.org | FASTLY | DE | suspicious |
— | — | 140.82.121.4:443 | github.com | GITHUB | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
github.com |
| malicious |
repo1.maven.org |
| whitelisted |
dns.msftncsi.com |
| shared |
objects.githubusercontent.com |
| shared |
str-master.pw |
| malicious |
teewirman.ddns.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.pw domain - Likely Hostile |
860 | java.exe | Potentially Bad Traffic | ET POLICY Vulnerable Java Version 1.8.x Detected |
860 | java.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.pw domain |
— | — | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.ddns .net |
1 ETPRO signatures available at the full report