Windows Analysis Report
dn-compiled-module.jar

Overview

General Information

Sample name: dn-compiled-module.jar
Analysis ID: 1483411
MD5: 9baedc9c520816e671957a4a7a1e354b
SHA1: b8ece17002aeb8fda221f9732cd1ff6a721497be
SHA256: 2f0f3e5fac55119cf67ea7950ee7dbbe2c5982986de51baccffc76c97f701585
Tags: 116-203-8-165jar
Infos:

Detection

Score: 52
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Exploit detected, runtime environment starts unknown processes
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: dn-compiled-module.jar ReversingLabs: Detection: 15%
Source: dn-compiled-module.jar Virustotal: Detection: 14% Perma Link

Software Vulnerabilities
barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe
Source: MainForm.phb.0.dr String found in binary or memory: http://77.91.77.145/?v=3&event=
Source: java.exe, 00000002.00000002.1654417055.0000000004A00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000002.00000002.1654417055.0000000004A00000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: AbstractFactory.phb.0.dr, MainForm.fxml.0.dr String found in binary or memory: http://javafx.com/fxml/1
Source: AbstractFactory.phb.0.dr, MainForm.fxml.0.dr String found in binary or memory: http://javafx.com/javafx/8
Source: jURL.phb.0.dr String found in binary or memory: http://site.com/
Source: java.exe, 00000002.00000002.1655535445.000000001513F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.oracle.com/technetwork/java/javase/documentation/index.html
Source: jURL.phb.0.dr String found in binary or memory: https://github.com/TsSaltan/DevelNext-jURL/releases/latest
Source: classification engine Classification label: mal52.expl.winJAR@7/174@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7412:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7572:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7468:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Windows\System32\7za.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: dn-compiled-module.jar ReversingLabs: Detection: 15%
Source: dn-compiled-module.jar Virustotal: Detection: 14%
Source: unknown Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\dn-compiled-module.jar"
Source: C:\Windows\System32\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\dn-compiled-module.jar"
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Windows\System32\7za.exe Section loaded: 7z.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: dn-compiled-module.jar Static file information: File size 1062389 > 1048576
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291A21B push ecx; ret 2_2_0291A225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291A20A push ecx; ret 2_2_0291A21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291B3B7 push 00000000h; mov dword ptr [esp], esp 2_2_0291B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291BB67 push 00000000h; mov dword ptr [esp], esp 2_2_0291BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291B947 push 00000000h; mov dword ptr [esp], esp 2_2_0291B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_0291C477 push 00000000h; mov dword ptr [esp], esp 2_2_0291C49D
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: java.exe, 00000002.00000003.1650939668.0000000014EF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000003.1650939668.0000000014EF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000002.00000002.1653868583.0000000000F64000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000002.00000003.1650939668.0000000014EF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000002.00000002.1653868583.0000000000F64000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000002.00000002.1653868583.0000000000F3B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllPJ
Source: java.exe, 00000002.00000003.1650939668.0000000014EF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 2_2_029103C0 cpuid 2_2_029103C0
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7460 VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\charsets.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1483411 Sample: dn-compiled-module.jar Startdate: 27/07/2024 Architecture: WINDOWS Score: 52 19 Multi AV Scanner detection for submitted file 2->19 21 Exploit detected, runtime environment starts unknown processes 2->21 7 java.exe 9 2->7         started        9 7za.exe 244 2->9         started        process3 process4 11 icacls.exe 1 7->11         started        13 conhost.exe 7->13         started        15 conhost.exe 9->15         started        process5 17 conhost.exe 11->17         started       
⊘No contacted IP infos