Analysis
- max time kernel
179s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20240319-en - resource tags
- submitted
03/04/2024, 16:47
General
- Target Sol.jar
- Size 639KB
- Sample240403-va2dzsff3y
- SHA256 71e6e2fe78006f93ad62ed82871ba58542741ea0ec0d180388fc421f8f93e89d
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Sol.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1712162896191.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1712162896191.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1712162896191.tmp" /f3⤵
- Adds Run key to start application
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5492 --field-trial-handle=2252,i,11231798169170618717,17890004712654885282,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1712162896191.tmp
memory/4452-43-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-84-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-23-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-12-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-32-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-34-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-35-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-38-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-39-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-40-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-41-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-47-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-16-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-4-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-42-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-49-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-50-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-60-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-62-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-63-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-68-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-72-0x0000019F8BBC0000-0x0000019F8BBC1000-memory.dmp
memory/4452-75-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-81-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-44-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-91-0x0000019F8D460000-0x0000019F8E460000-memory.dmp
memory/4452-92-0x0000019F8D460000-0x0000019F8E460000-memory.dmp