9b6375e77c9cad35192e9809e853514f4ee8e9f2a1fd29d40be8282ee8e2a387

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e2285d864c196f712a044eeeb2a827f7.jar
Size 639KB
Sample240125-dnjyesfcgj
SHA256 9b6375e77c9cad35192e9809e853514f4ee8e9f2a1fd29d40be8282ee8e2a387
MD5 e2285d864c196f712a044eeeb2a827f7
SHA1 46c1a6c41ad38502326348b719e0657b7b05f232
SHA512 a5a6e121dde33faa4b1ccdf381d5febe89ed820939028fad432e91f8bfcaa78c590f60a2f8100e9cd699c683309a2cc3f8243738334889faacbab3eadefc64f0
SSDEEP 12288:SbDdQd/fv5oPB4R1Y5grgq/XR7+5vUNGnGgyNqRZ43MuA2NoSm9DEb:SbZQd5oJ47rrgqJmOGnvMJMuNNzm9DEb
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3884	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1706152175945.tmp"	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4036	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3884	4036	java.exe	87
PID 4036 wrote to memory of 3884	4036	java.exe	87
PID 4036 wrote to memory of 3304	4036	java.exe	92
PID 4036 wrote to memory of 3304	4036	java.exe	92
PID 4036 wrote to memory of 1544	4036	java.exe	94
PID 4036 wrote to memory of 1544	4036	java.exe	94
PID 1544 wrote to memory of 2788	1544	cmd.exe	96
PID 1544 wrote to memory of 2788	1544	cmd.exe	96

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3304	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\e2285d864c196f712a044eeeb2a827f7.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3884
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1706152175945.tmp
  2⤵
  - Views/modifies file attributes
  PID:3304
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1706152175945.tmp" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1706152175945.tmp" /f
    3⤵
    - Adds Run key to start application
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 974bd011d0c76dbf158242c3558e3d02c636cd95567ea8b615b3778c307191d0
MD5 e353b8eded4c2afb2e82005488656725
SHA1 754d126743fda7c89c81f7c348ae2fb8dc27ad95
SHA512 e04493ab4b780e36aa4a65fd239b7909ae6d90b202c43d173b0c2cc8e08043b8e3eaca0524398e994b70d82475e2e82e69407ecb2818a4c837b05ce46ef307bc
MD5 SHA1 SHA512

Submit Download

1706152175945.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1706152175945.tmp
Size 639KB
SHA256 9b6375e77c9cad35192e9809e853514f4ee8e9f2a1fd29d40be8282ee8e2a387
MD5 e2285d864c196f712a044eeeb2a827f7
SHA1 46c1a6c41ad38502326348b719e0657b7b05f232
SHA512 a5a6e121dde33faa4b1ccdf381d5febe89ed820939028fad432e91f8bfcaa78c590f60a2f8100e9cd699c683309a2cc3f8243738334889faacbab3eadefc64f0
SSDEEP 12288:SbDdQd/fv5oPB4R1Y5grgq/XR7+5vUNGnGgyNqRZ43MuA2NoSm9DEb:SbZQd5oJ47rrgqJmOGnvMJMuNNzm9DEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4036-33-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-34-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-15-0x000001F206B50000-0x000001F206B51000-memory.dmp

Download

memory/4036-26-0x000001F206B50000-0x000001F206B51000-memory.dmp

Download

memory/4036-30-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-31-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-4-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-21-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-38-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-39-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-41-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-42-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-43-0x000001F208360000-0x000001F209360000-memory.dmp

Download

memory/4036-44-0x000001F208360000-0x000001F209360000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads