0aa6491b61b2dbbd8e24f13dcfcd795fc62b943fa6ad9441435c673d010a7871

General

Target

1.16.5.jar
Size

639KB
MD5

f03c1b24fdfba7ec585ec71898b42f4e
SHA1

d1a453cb70e52f94386ce3d3009baa675a311004
SHA256

0aa6491b61b2dbbd8e24f13dcfcd795fc62b943fa6ad9441435c673d010a7871
SHA512

1a7cb53978236da109368ca04553ef6c42b77a7ccfa31af0e1491ea592d4db28b3af92fc7c4623c52acc9bacd3e62deef3e2a16296b2d4c4debe6280e49c9807
SSDEEP

12288:u/PhQN/rTZMrF4Vlwxszgu/DRL+hXwNqfqgyh6RNc30uE2hUS6VDEz:u/ZQNRMB4jDzguNmSqfLYp0uZhn6VDEz

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1012 icacls.exe

pid	process
1012	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1714544989113.tmp"	reg.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

64 checkip.amazonaws.com
65 checkip.amazonaws.com
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

java.exe

pid process

1104 java.exe
1104 java.exe
1104 java.exe
1104 java.exe
1104 java.exe
1104 java.exe
1104 java.exe

flow	ioc
64	checkip.amazonaws.com
65	checkip.amazonaws.com

pid	process
1104	java.exe
1104	java.exe
1104	java.exe
1104	java.exe
1104	java.exe
1104	java.exe
1104	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

java.execmd.exe

description	pid	process	target process
PID 1104 wrote to memory of 1012	1104	java.exe	icacls.exe
PID 1104 wrote to memory of 1012	1104	java.exe	icacls.exe
PID 1104 wrote to memory of 3016	1104	java.exe	attrib.exe
PID 1104 wrote to memory of 3016	1104	java.exe	attrib.exe
PID 1104 wrote to memory of 5960	1104	java.exe	cmd.exe
PID 1104 wrote to memory of 5960	1104	java.exe	cmd.exe
PID 5960 wrote to memory of 1380	5960	cmd.exe	reg.exe
PID 5960 wrote to memory of 1380	5960	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3016 attrib.exe

pid	process
3016	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\1.16.5.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1012

C:\Windows\SYSTEM32\attrib.exe
attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714544989113.tmp
2⤵
- Views/modifies file attributes
PID:3016

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714544989113.tmp" /f"
2⤵
- Suspicious use of WriteProcessMemory
PID:5960

C:\Windows\system32\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714544989113.tmp" /f
3⤵
- Adds Run key to start application
PID:1380

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

1

T1222

Modify Registry

1

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
9b6ec8c7bee705ba1a0827814d9e6dd7

SHA1
6d25661b9d2edf10c28cd59e3585501571ef271e

SHA256
ea020b200bc7ceb378c3138b7428d4c8c84a1ddb6675580a7a244841627f6694

SHA512
5f18bcb73a099300a768345f077cfbc8556557bda154ea5a22cce4b71d519800d79f3033389e8ab3e7259a84e70b63536a6f1c06e23bab332130ad8344d3f939

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714544989113.tmp
Filesize
639KB

MD5
f03c1b24fdfba7ec585ec71898b42f4e

SHA1
d1a453cb70e52f94386ce3d3009baa675a311004

SHA256
0aa6491b61b2dbbd8e24f13dcfcd795fc62b943fa6ad9441435c673d010a7871

SHA512
1a7cb53978236da109368ca04553ef6c42b77a7ccfa31af0e1491ea592d4db28b3af92fc7c4623c52acc9bacd3e62deef3e2a16296b2d4c4debe6280e49c9807

Download Submit
memory/1104-10-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-15-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-24-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-28-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-31-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-38-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-47-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-49-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-51-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-52-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-53-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-56-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-57-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-58-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-61-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-62-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-63-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-64-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-66-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-68-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-71-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-72-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-75-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-96-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-97-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-98-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-99-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-108-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-115-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-117-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-118-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-119-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-125-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-127-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-132-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-135-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-136-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-137-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-150-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-151-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-152-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-153-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-157-0x0000013FC8E30000-0x0000013FC8E31000-memory.dmp

Filesize
4KB

Download
memory/1104-173-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-174-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-179-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-182-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-183-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-185-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-192-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-193-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-196-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-199-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-200-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-202-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-208-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download
memory/1104-211-0x0000013FC8E50000-0x0000013FC9E50000-memory.dmp

Filesize
16.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads