Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
01/05/2024, 06:33
General
- Target 1.16.5.jar
- Size 639KB
- Sample240501-hbl98scc57
- SHA256 0aa6491b61b2dbbd8e24f13dcfcd795fc62b943fa6ad9441435c673d010a7871
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\1.16.5.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714545238998.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714545238998.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1714545238998.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1714545238998.tmp
memory/3380-54-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-68-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-15-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-34-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-40-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-44-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-46-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-48-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-49-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-53-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-10-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-56-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-24-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-60-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-58-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-61-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-62-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-63-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-64-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-65-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-66-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-59-0x000001FDDF320000-0x000001FDDF321000-memory.dmp
memory/3380-71-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-72-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp
memory/3380-74-0x000001FDE0BA0000-0x000001FDE1BA0000-memory.dmp