Analysis
- max time kernel
129s - max time network
129s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
11/05/2024, 14:52
General
- Target 100virus.jar
- Size 639KB
- Sample240511-r8vgjsfc63
- SHA256 2acb09ed1bc32e9f0ffb1abae14398e7e76cee7d44663871b912160b53cffdff
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\100virus.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147404.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147404.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147404.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1715439147404.tmp
memory/4912-2-0x000001D282410000-0x000001D282680000-memory.dmp
memory/4912-17-0x000001D282680000-0x000001D282690000-memory.dmp
memory/4912-18-0x000001D282690000-0x000001D2826A0000-memory.dmp
memory/4912-20-0x000001D2826A0000-0x000001D2826B0000-memory.dmp
memory/4912-22-0x000001D2826B0000-0x000001D2826C0000-memory.dmp
memory/4912-24-0x000001D2826C0000-0x000001D2826D0000-memory.dmp
memory/4912-26-0x000001D2826D0000-0x000001D2826E0000-memory.dmp
memory/4912-28-0x000001D2826E0000-0x000001D2826F0000-memory.dmp
memory/4912-31-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-35-0x000001D2826F0000-0x000001D282700000-memory.dmp
memory/4912-39-0x000001D282700000-0x000001D282710000-memory.dmp
memory/4912-40-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-44-0x000001D282720000-0x000001D282730000-memory.dmp
memory/4912-45-0x000001D282680000-0x000001D282690000-memory.dmp
memory/4912-43-0x000001D282710000-0x000001D282720000-memory.dmp
memory/4912-42-0x000001D282410000-0x000001D282680000-memory.dmp
memory/4912-50-0x000001D282690000-0x000001D2826A0000-memory.dmp
memory/4912-51-0x000001D282730000-0x000001D282740000-memory.dmp
memory/4912-53-0x000001D2826A0000-0x000001D2826B0000-memory.dmp
memory/4912-54-0x000001D282740000-0x000001D282750000-memory.dmp
memory/4912-57-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-58-0x000001D2826B0000-0x000001D2826C0000-memory.dmp
memory/4912-60-0x000001D282750000-0x000001D282760000-memory.dmp
memory/4912-62-0x000001D282760000-0x000001D282770000-memory.dmp
memory/4912-61-0x000001D2826C0000-0x000001D2826D0000-memory.dmp
memory/4912-63-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-66-0x000001D2826D0000-0x000001D2826E0000-memory.dmp
memory/4912-67-0x000001D282770000-0x000001D282780000-memory.dmp
memory/4912-68-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-71-0x000001D2826E0000-0x000001D2826F0000-memory.dmp
memory/4912-72-0x000001D282780000-0x000001D282790000-memory.dmp
memory/4912-75-0x000001D2826F0000-0x000001D282700000-memory.dmp
memory/4912-76-0x000001D282790000-0x000001D2827A0000-memory.dmp
memory/4912-78-0x000001D282700000-0x000001D282710000-memory.dmp
memory/4912-79-0x000001D2827A0000-0x000001D2827B0000-memory.dmp
memory/4912-82-0x000001D282710000-0x000001D282720000-memory.dmp
memory/4912-83-0x000001D2827B0000-0x000001D2827C0000-memory.dmp
memory/4912-85-0x000001D282720000-0x000001D282730000-memory.dmp
memory/4912-86-0x000001D2827C0000-0x000001D2827D0000-memory.dmp
memory/4912-90-0x000001D2827D0000-0x000001D2827E0000-memory.dmp
memory/4912-89-0x000001D282730000-0x000001D282740000-memory.dmp
memory/4912-92-0x000001D282740000-0x000001D282750000-memory.dmp
memory/4912-93-0x000001D2827E0000-0x000001D2827F0000-memory.dmp
memory/4912-94-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-95-0x000001D282750000-0x000001D282760000-memory.dmp
memory/4912-96-0x000001D282760000-0x000001D282770000-memory.dmp
memory/4912-97-0x000001D282770000-0x000001D282780000-memory.dmp
memory/4912-99-0x000001D282780000-0x000001D282790000-memory.dmp
memory/4912-101-0x000001D2827F0000-0x000001D282800000-memory.dmp
memory/4912-100-0x000001D282790000-0x000001D2827A0000-memory.dmp
memory/4912-102-0x000001D280B10000-0x000001D280B11000-memory.dmp
memory/4912-103-0x000001D2827A0000-0x000001D2827B0000-memory.dmp
memory/4912-104-0x000001D2827B0000-0x000001D2827C0000-memory.dmp
memory/4912-105-0x000001D2827C0000-0x000001D2827D0000-memory.dmp
memory/4912-106-0x000001D2827D0000-0x000001D2827E0000-memory.dmp
memory/4912-107-0x000001D2827E0000-0x000001D2827F0000-memory.dmp
memory/4912-108-0x000001D2827F0000-0x000001D282800000-memory.dmp
memory/4912-112-0x000001D282800000-0x000001D282810000-memory.dmp
memory/4912-116-0x000001D282820000-0x000001D282830000-memory.dmp