Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Sept. 7, 2021, 7:43 p.m. | Sept. 7, 2021, 7:45 p.m. |
-
java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar C:\Users\test22\AppData\Local\Temp\SupplierRemittance.jar
2336-
java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar "C:\Program Files (x86)\Java\jre1.8.0_131\SupplierRemittance.jar"
2160-
java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar "C:\Users\test22\SupplierRemittance.jar"
2812-
cmd.exe cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar"
2056-
schtasks.exe schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar"
2840
-
-
java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar"
2332-
cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"
300-
WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list
1520
-
-
cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"
2560-
WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list
1288
-
-
cmd.exe cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"
2172-
WMIC.exe wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list
740
-
-
cmd.exe cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"
2980-
WMIC.exe wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list
2760
-
-
-
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
repo1.maven.org |
CNAME
sonatype.map.fastly.net
|
199.232.196.209 |
github-releases.githubusercontent.com | 185.199.109.154 | |
github.com | 15.164.81.167 | |
ip-api.com | 208.95.112.1 | |
stracc1.ddnsking.com | 91.193.75.160 |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLS 1.2 192.168.56.103:49166 52.78.231.108:443 |
C=US, O=DigiCert, Inc., CN=DigiCert High Assurance TLS Hybrid ECC SHA256 2020 CA1 | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=github.com | 84:63:b3:a9:29:12:cc:fd:1d:31:47:05:98:9b:ec:13:99:37:d0:d7 |
TLS 1.2 192.168.56.103:49167 151.101.196.209:443 |
C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA | C=US, ST=Maryland, L=Fulton, O=Sonatype, Inc, CN=repo1.maven.org | 74:54:1d:15:cf:77:9e:e8:00:c2:ea:0d:77:6e:d3:02:51:0f:15:dd |
TLS 1.2 192.168.56.103:49169 151.101.196.209:443 |
C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA | C=US, ST=Maryland, L=Fulton, O=Sonatype, Inc, CN=repo1.maven.org | 74:54:1d:15:cf:77:9e:e8:00:c2:ea:0d:77:6e:d3:02:51:0f:15:dd |
TLS 1.2 192.168.56.103:49168 151.101.196.209:443 |
C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA | C=US, ST=Maryland, L=Fulton, O=Sonatype, Inc, CN=repo1.maven.org | 74:54:1d:15:cf:77:9e:e8:00:c2:ea:0d:77:6e:d3:02:51:0f:15:dd |
TLS 1.2 192.168.56.103:49172 185.199.109.154:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA | C=US, ST=California, L=San Francisco, O=GitHub, Inc., CN=www.github.com | 70:94:de:dd:e6:c4:69:48:3a:92:70:a1:48:56:78:2d:18:64:e0:b7 |
domain | stracc1.ddnsking.com |
request | GET http://ip-api.com/json/ |
domain | ip-api.com |
file | C:\Users\test22\AppData\Local\Temp\jna--877171118\jna7459621280056494850.dll |
file | C:\Users\test22\AppData\Local\Temp\jna--877171118\jna5526630482485138876.dll |
cmdline | cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list" |
cmdline | cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list" |
cmdline | schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list" |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list" |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list |
cmdline | wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list |
file | C:\Users\test22\AppData\Local\Temp\jna--877171118\jna5526630482485138876.dll |
cmdline | cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list" |
cmdline | cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list" |
cmdline | schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list" |
cmdline | cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list" |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list |
cmdline | wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list |
cmdline | wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list |
wmi | SELECT VolumeSerialNumber FROM win32_logicaldisk |
reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SupplierRemittance | reg_value | "C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" | ||||||
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SupplierRemittance | reg_value | "C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe" -jar "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" | ||||||
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SupplierRemittance.jar | ||||||||
file | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SupplierRemittance.jar | ||||||||
cmdline | cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" | ||||||||
cmdline | schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\test22\AppData\Roaming\SupplierRemittance.jar" |
wmi | SELECT Caption, OSArchitecture FROM win32_operatingsystem |
wmi | SELECT displayName FROM antivirusproduct |
wmi | SELECT VolumeSerialNumber FROM win32_logicaldisk |
wmi | SELECT Version FROM win32_operatingsystem |
MicroWorld-eScan | Java.Trojan.GenericGBA.30531 |
FireEye | Java.Trojan.GenericGBA.30531 |
Arcabit | Java.Trojan.GenericGBA.D7743 |
ESET-NOD32 | a variant of Java/Spy.Agent.Y |
BitDefender | Java.Trojan.GenericGBA.30531 |
Ad-Aware | Java.Trojan.GenericGBA.30531 |
Emsisoft | Java.Trojan.GenericGBA.30531 (B) |
GData | Java.Trojan.GenericGBA.30531 |
MAX | malware (ai score=80) |
Ikarus | Trojan.Java.Spy |
file | C:\Users\test22\Documents\Outlook 파일\Outlook.pst |
file | C:\Users\test22\AppData\Local\Temp\jna--877171118\jna5526630482485138876.dll |
file | C:\Users\test22\AppData\Local\Temp\jna--877171118\jna7459621280056494850.dll |