Analysis
- max time kernel
315s - max time network
1605s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
16/03/2024, 13:04
General
- Target 9999.jar
- Size 639KB
- Sample240316-qa2yasdf22
- SHA256 82c6e66b92a106822693cc8011cc8d99c1b889a8afb01518ff4a0cc163e07094
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\9999.jar1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/1568-36-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-12-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-20-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-22-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-29-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-30-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-31-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-32-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-6-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-35-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-39-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-38-0x0000023819770000-0x0000023819771000-memory.dmp
memory/1568-37-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-40-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-43-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-44-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-45-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-46-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-47-0x000002381AFE0000-0x000002381BFE0000-memory.dmp
memory/1568-48-0x000002381AFE0000-0x000002381BFE0000-memory.dmp