Windows Analysis Report
Fattura (3).jar

Overview

General Information

Sample name: Fattura (3).jar
Analysis ID: 1546102
MD5: 3cd537cdd92f2f82bf0f402714a486fc
SHA1: 4d0b62e3192c478b31909ea9688819623e64a2e7
SHA256: 37e0addebe5c3e8487dd1b5d5c3d239fc15dca0f936280784cf0fa78a9ee1ee0
Tags: jarSPAM-ITAuser-JAMESWT_MHT
Infos:

Detection

Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Exploit detected, runtime environment starts unknown processes
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to query CPU information (cpuid)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Found inlined nop instructions (likely shell or obfuscated code)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Suricata IDS alerts with low severity for network traffic
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Fattura (3).jar Avira: detected
Multi AV Scanner detection for submitted file
Source: Fattura (3).jar ReversingLabs: Detection: 31%

Software Vulnerabilities
barindex
Exploit detected, runtime environment starts unknown processes
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 4x nop then cmp eax, dword ptr [ecx+04h] 3_2_02C61DD8
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.8:49704 -> 116.203.56.216:33380
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.8:49727
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.8:49794
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: de4.localto.net
Source: java.exe, 00000003.00000002.2707410158.000000000A3C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
Source: java.exe, 00000003.00000003.1500633291.000000001596B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A39D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2709045350.0000000015972000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500514052.0000000015953000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500229038.0000000015943000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
Source: java.exe, 00000003.00000003.1500633291.000000001596B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A39D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2709045350.0000000015972000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500514052.0000000015953000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500229038.0000000015943000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl
Source: java.exe, 00000003.00000003.1500633291.000000001596B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2709045350.0000000015972000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500514052.0000000015953000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500229038.0000000015943000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://java.oracle.com/
Source: java.exe, 00000003.00000003.1500435091.0000000015908000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500306477.0000000015902000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A525000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2708953166.0000000015908000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://null.oracle.com/
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0A
Source: java.exe, 00000003.00000003.1500633291.000000001596B000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A39D000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000002.2709045350.0000000015972000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500514052.0000000015953000.00000004.00000020.00020000.00000000.sdmp, java.exe, 00000003.00000003.1500229038.0000000015943000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0C
Source: java.exe, 00000003.00000002.2707410158.000000000A3D0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0X
Source: classification engine Classification label: mal60.expl.winJAR@7/194@1/1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4472:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2888:120:WilError_03
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user Jump to behavior
Source: C:\Windows\System32\7za.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Fattura (3).jar ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\Fattura (3).jar"
Source: C:\Windows\System32\7za.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\Fattura (3).jar" IIllIlI.lIlIIlIlIl.IIlIlIlIIl.lIllIlIIlI.IlIIllIlIlIIllIIl
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Source: C:\Windows\System32\7za.exe Section loaded: 7z.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02C60F9D push ebx; retf 3_2_02C6103A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02C60F98 push ebx; retf 3_2_02C6103A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02C59C91 push cs; retf 3_2_02C59CB1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02C6103B push cs; retf 3_2_02C610B1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBD8F7 push 00000000h; mov dword ptr [esp], esp 3_2_02BBD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBA21B push ecx; ret 3_2_02BBA225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBA20A push ecx; ret 3_2_02BBA21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBB3B7 push 00000000h; mov dword ptr [esp], esp 3_2_02BBB3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBBB67 push 00000000h; mov dword ptr [esp], esp 3_2_02BBBB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBD8E0 push 00000000h; mov dword ptr [esp], esp 3_2_02BBD921
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBB947 push 00000000h; mov dword ptr [esp], esp 3_2_02BBB96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BBC477 push 00000000h; mov dword ptr [esp], esp 3_2_02BBC49D
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: java.exe, 00000003.00000003.1447423663.0000000015266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000003.00000003.1447423663.0000000015266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000003.00000002.2705996602.000000000102B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000003.00000003.1447423663.0000000015266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000003.00000002.2705996602.000000000102B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000003.00000003.1447423663.0000000015266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000003.00000002.2705996602.000000000102B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02C592B7 LdrInitializeThunk,LdrInitializeThunk, 3_2_02C592B7
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Memory protected: page read and write | page guard Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M Jump to behavior
Contains functionality to query CPU information (cpuid)
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Code function: 3_2_02BB03C0 cpuid 3_2_02BB03C0
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\5388 VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546102 Sample: Fattura (3).jar Startdate: 31/10/2024 Architecture: WINDOWS Score: 60 21 de4.localto.net 2->21 25 Antivirus / Scanner detection for submitted sample 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 Exploit detected, runtime environment starts unknown processes 2->29 8 java.exe 9 2->8         started        11 7za.exe 202 2->11         started        signatures3 process4 dnsIp5 23 de4.localto.net 116.203.56.216, 33380, 49704, 49705 HETZNER-ASDE Germany 8->23 13 icacls.exe 1 8->13         started        15 conhost.exe 8->15         started        17 conhost.exe 11->17         started        process6 process7 19 conhost.exe 13->19         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
116.203.56.216
 de4.localto.net Germany
24940 HETZNER-ASDE false

Contacted Domains

Name IP Active
de4.localto.net 116.203.56.216 true