Analysis
- max time kernel
283s - max time network
301s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/05/2024, 14:52
General
- Target 100virus.jar
- Size 639KB
- Sample240511-r8vgjsfc63
- SHA256 2acb09ed1bc32e9f0ffb1abae14398e7e76cee7d44663871b912160b53cffdff
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\100virus.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147674.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147674.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1715439147674.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
imageio179281659885797086.tmp
imageio2004206962521674609.tmp
imageio3852857925670391443.tmp
imageio399712359170724536.tmp
imageio4370069955398092231.tmp
imageio4477576661992792930.tmp
imageio5587297936377290916.tmp
imageio6357271913089154793.tmp
imageio6932064106177544084.tmp
imageio7092955639247487241.tmp
imageio8800149815291982035.tmp
imageio8944681807376019099.tmp
1715439147674.tmp
memory/3144-131-0x0000022A0EC80000-0x0000022A0EC90000-memory.dmp
memory/3144-244-0x0000022A0ECE0000-0x0000022A0ECF0000-memory.dmp
memory/3144-40-0x0000022A0EB80000-0x0000022A0EB90000-memory.dmp
memory/3144-43-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-46-0x0000022A0EB90000-0x0000022A0EBA0000-memory.dmp
memory/3144-45-0x0000022A0E880000-0x0000022A0EAF0000-memory.dmp
memory/3144-48-0x0000022A0EAF0000-0x0000022A0EB00000-memory.dmp
memory/3144-50-0x0000022A0EBA0000-0x0000022A0EBB0000-memory.dmp
memory/3144-49-0x0000022A0EB00000-0x0000022A0EB10000-memory.dmp
memory/3144-54-0x0000022A0EBB0000-0x0000022A0EBC0000-memory.dmp
memory/3144-53-0x0000022A0EB10000-0x0000022A0EB20000-memory.dmp
memory/3144-58-0x0000022A0EBC0000-0x0000022A0EBD0000-memory.dmp
memory/3144-57-0x0000022A0EB30000-0x0000022A0EB40000-memory.dmp
memory/3144-56-0x0000022A0EB20000-0x0000022A0EB30000-memory.dmp
memory/3144-62-0x0000022A0EBD0000-0x0000022A0EBE0000-memory.dmp
memory/3144-65-0x0000022A0EBE0000-0x0000022A0EBF0000-memory.dmp
memory/3144-64-0x0000022A0EB40000-0x0000022A0EB50000-memory.dmp
memory/3144-66-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-69-0x0000022A0EBF0000-0x0000022A0EC00000-memory.dmp
memory/3144-68-0x0000022A0EB50000-0x0000022A0EB60000-memory.dmp
memory/3144-72-0x0000022A0EB60000-0x0000022A0EB70000-memory.dmp
memory/3144-73-0x0000022A0EB70000-0x0000022A0EB80000-memory.dmp
memory/3144-74-0x0000022A0EB80000-0x0000022A0EB90000-memory.dmp
memory/3144-75-0x0000022A0EB90000-0x0000022A0EBA0000-memory.dmp
memory/3144-76-0x0000022A0EBA0000-0x0000022A0EBB0000-memory.dmp
memory/3144-77-0x0000022A0EBB0000-0x0000022A0EBC0000-memory.dmp
memory/3144-78-0x0000022A0EBC0000-0x0000022A0EBD0000-memory.dmp
memory/3144-80-0x0000022A0EBD0000-0x0000022A0EBE0000-memory.dmp
memory/3144-81-0x0000022A0EBE0000-0x0000022A0EBF0000-memory.dmp
memory/3144-82-0x0000022A0EBF0000-0x0000022A0EC00000-memory.dmp
memory/3144-84-0x0000022A0EC00000-0x0000022A0EC10000-memory.dmp
memory/3144-90-0x0000022A0EC10000-0x0000022A0EC20000-memory.dmp
memory/3144-91-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-94-0x0000022A0EC20000-0x0000022A0EC30000-memory.dmp
memory/3144-95-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-96-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-99-0x0000022A0EC30000-0x0000022A0EC40000-memory.dmp
memory/3144-103-0x0000022A0EC40000-0x0000022A0EC50000-memory.dmp
memory/3144-104-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-106-0x0000022A0EC50000-0x0000022A0EC60000-memory.dmp
memory/3144-105-0x0000022A0EC00000-0x0000022A0EC10000-memory.dmp
memory/3144-111-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-121-0x0000022A0EC60000-0x0000022A0EC70000-memory.dmp
memory/3144-124-0x0000022A0EC70000-0x0000022A0EC80000-memory.dmp
memory/3144-31-0x0000022A0EB60000-0x0000022A0EB70000-memory.dmp
memory/3144-132-0x0000022A0EC90000-0x0000022A0ECA0000-memory.dmp
memory/3144-171-0x0000022A0ECA0000-0x0000022A0ECB0000-memory.dmp
memory/3144-183-0x0000022A0ECC0000-0x0000022A0ECD0000-memory.dmp
memory/3144-182-0x0000022A0EC10000-0x0000022A0EC20000-memory.dmp
memory/3144-223-0x0000022A0ECD0000-0x0000022A0ECE0000-memory.dmp
memory/3144-222-0x0000022A0EC20000-0x0000022A0EC30000-memory.dmp
memory/3144-38-0x0000022A0EB70000-0x0000022A0EB80000-memory.dmp
memory/3144-243-0x0000022A0EC30000-0x0000022A0EC40000-memory.dmp
memory/3144-288-0x0000022A0ECF0000-0x0000022A0ED00000-memory.dmp
memory/3144-287-0x0000022A0EC40000-0x0000022A0EC50000-memory.dmp
memory/3144-312-0x0000022A0ED00000-0x0000022A0ED10000-memory.dmp
memory/3144-311-0x0000022A0EC50000-0x0000022A0EC60000-memory.dmp
memory/3144-340-0x0000022A0ED10000-0x0000022A0ED20000-memory.dmp
memory/3144-339-0x0000022A0EC60000-0x0000022A0EC70000-memory.dmp
memory/3144-374-0x0000022A0EC70000-0x0000022A0EC80000-memory.dmp
memory/3144-375-0x0000022A0ED20000-0x0000022A0ED30000-memory.dmp
memory/3144-412-0x0000022A0ED30000-0x0000022A0ED40000-memory.dmp
memory/3144-411-0x0000022A0EC80000-0x0000022A0EC90000-memory.dmp
memory/3144-427-0x0000022A0ED40000-0x0000022A0ED50000-memory.dmp
memory/3144-426-0x0000022A0EC90000-0x0000022A0ECA0000-memory.dmp
memory/3144-439-0x0000022A0ECA0000-0x0000022A0ECB0000-memory.dmp
memory/3144-440-0x0000022A0ED50000-0x0000022A0ED60000-memory.dmp
memory/3144-468-0x0000022A0ED60000-0x0000022A0ED70000-memory.dmp
memory/3144-467-0x0000022A0ECC0000-0x0000022A0ECD0000-memory.dmp
memory/3144-527-0x0000022A0ED70000-0x0000022A0ED80000-memory.dmp
memory/3144-526-0x0000022A0ECD0000-0x0000022A0ECE0000-memory.dmp
memory/3144-562-0x0000022A0ED80000-0x0000022A0ED90000-memory.dmp
memory/3144-561-0x0000022A0ECE0000-0x0000022A0ECF0000-memory.dmp
memory/3144-581-0x0000022A0ED90000-0x0000022A0EDA0000-memory.dmp
memory/3144-580-0x0000022A0ECF0000-0x0000022A0ED00000-memory.dmp
memory/3144-666-0x0000022A0ED00000-0x0000022A0ED10000-memory.dmp
memory/3144-758-0x0000022A0ED10000-0x0000022A0ED20000-memory.dmp
memory/3144-793-0x0000022A0EDA0000-0x0000022A0EDB0000-memory.dmp
memory/3144-792-0x0000022A0ED20000-0x0000022A0ED30000-memory.dmp
memory/3144-890-0x0000022A0ED30000-0x0000022A0ED40000-memory.dmp
memory/3144-915-0x0000022A0EDB0000-0x0000022A0EDC0000-memory.dmp
memory/3144-914-0x0000022A0ED40000-0x0000022A0ED50000-memory.dmp
memory/3144-991-0x0000022A0EDC0000-0x0000022A0EDD0000-memory.dmp
memory/3144-990-0x0000022A0ED50000-0x0000022A0ED60000-memory.dmp
memory/3144-1005-0x0000022A0EDD0000-0x0000022A0EDE0000-memory.dmp
memory/3144-1004-0x0000022A0ED60000-0x0000022A0ED70000-memory.dmp
memory/3144-1099-0x0000022A0EDE0000-0x0000022A0EDF0000-memory.dmp
memory/3144-1098-0x0000022A0ED70000-0x0000022A0ED80000-memory.dmp
memory/3144-1184-0x0000022A0ED80000-0x0000022A0ED90000-memory.dmp
memory/3144-1264-0x0000022A0ED90000-0x0000022A0EDA0000-memory.dmp
memory/3144-1476-0x0000022A0EDF0000-0x0000022A0EE00000-memory.dmp
memory/3144-1475-0x0000022A0EDA0000-0x0000022A0EDB0000-memory.dmp
memory/3144-1481-0x0000022A0EE00000-0x0000022A0EE10000-memory.dmp
memory/3144-29-0x0000022A0E860000-0x0000022A0E861000-memory.dmp
memory/3144-28-0x0000022A0EB50000-0x0000022A0EB60000-memory.dmp
memory/3144-25-0x0000022A0EB30000-0x0000022A0EB40000-memory.dmp
memory/3144-26-0x0000022A0EB40000-0x0000022A0EB50000-memory.dmp
memory/3144-22-0x0000022A0EB20000-0x0000022A0EB30000-memory.dmp
memory/3144-20-0x0000022A0EB10000-0x0000022A0EB20000-memory.dmp
memory/3144-17-0x0000022A0EAF0000-0x0000022A0EB00000-memory.dmp
memory/3144-18-0x0000022A0EB00000-0x0000022A0EB10000-memory.dmp
memory/3144-2-0x0000022A0E880000-0x0000022A0EAF0000-memory.dmp
memory/3144-1538-0x0000022A0EE10000-0x0000022A0EE20000-memory.dmp
memory/3144-1537-0x0000022A0EDB0000-0x0000022A0EDC0000-memory.dmp