Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
19/05/2024, 15:13
General
- Target addononlyrp.jar
- Size 639KB
- Sample240519-slsj4sce75
- SHA256 5633e5714316695c907b7ae86a11c15459f0e945ca19e72179e32dd32a5b29a4
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\addononlyrp.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716131613539.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716131613539.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1716131613539.tmp" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004E41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
imageio1939816257214164021.tmp
imageio2561855856219587895.tmp
imageio3231952896959347092.tmp
imageio3811767286316336032.tmp
imageio460782145742391609.tmp
imageio5802949615903933364.tmp
imageio5875136266928549452.tmp
imageio8019707744387209290.tmp
imageio8897172622171167345.tmp
imageio944167185050421737.tmp
1716131613539.tmp
memory/2748-339-0x000001FB28100000-0x000001FB28110000-memory.dmp
memory/2748-80-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-32-0x000001FB27FE0000-0x000001FB27FF0000-memory.dmp
memory/2748-34-0x000001FB27FF0000-0x000001FB28000000-memory.dmp
memory/2748-41-0x000001FB28000000-0x000001FB28010000-memory.dmp
memory/2748-42-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-47-0x000001FB28010000-0x000001FB28020000-memory.dmp
memory/2748-46-0x000001FB27D00000-0x000001FB27F70000-memory.dmp
memory/2748-48-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-49-0x000001FB27F70000-0x000001FB27F80000-memory.dmp
memory/2748-50-0x000001FB27F80000-0x000001FB27F90000-memory.dmp
memory/2748-51-0x000001FB27F90000-0x000001FB27FA0000-memory.dmp
memory/2748-52-0x000001FB27FA0000-0x000001FB27FB0000-memory.dmp
memory/2748-53-0x000001FB27FB0000-0x000001FB27FC0000-memory.dmp
memory/2748-54-0x000001FB27FC0000-0x000001FB27FD0000-memory.dmp
memory/2748-55-0x000001FB27FD0000-0x000001FB27FE0000-memory.dmp
memory/2748-56-0x000001FB27FE0000-0x000001FB27FF0000-memory.dmp
memory/2748-58-0x000001FB27FF0000-0x000001FB28000000-memory.dmp
memory/2748-59-0x000001FB28000000-0x000001FB28010000-memory.dmp
memory/2748-60-0x000001FB28010000-0x000001FB28020000-memory.dmp
memory/2748-63-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-65-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-68-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-69-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-77-0x000001FB28020000-0x000001FB28030000-memory.dmp
memory/2748-451-0x000001FB28070000-0x000001FB28080000-memory.dmp
memory/2748-83-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-86-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-88-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-90-0x000001FB28020000-0x000001FB28030000-memory.dmp
memory/2748-91-0x000001FB28030000-0x000001FB28040000-memory.dmp
memory/2748-92-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-97-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-98-0x000001FB28040000-0x000001FB28050000-memory.dmp
memory/2748-103-0x000001FB28050000-0x000001FB28060000-memory.dmp
memory/2748-106-0x000001FB28060000-0x000001FB28070000-memory.dmp
memory/2748-109-0x000001FB28070000-0x000001FB28080000-memory.dmp
memory/2748-110-0x000001FB28080000-0x000001FB28090000-memory.dmp
memory/2748-117-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-122-0x000001FB28090000-0x000001FB280A0000-memory.dmp
memory/2748-130-0x000001FB280A0000-0x000001FB280B0000-memory.dmp
memory/2748-132-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-143-0x000001FB280B0000-0x000001FB280C0000-memory.dmp
memory/2748-155-0x000001FB280D0000-0x000001FB280E0000-memory.dmp
memory/2748-170-0x000001FB280E0000-0x000001FB280F0000-memory.dmp
memory/2748-172-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-290-0x000001FB28030000-0x000001FB28040000-memory.dmp
memory/2748-334-0x000001FB28040000-0x000001FB28050000-memory.dmp
memory/2748-452-0x000001FB28080000-0x000001FB28090000-memory.dmp
memory/2748-338-0x000001FB28050000-0x000001FB28060000-memory.dmp
memory/2748-28-0x000001FB27FD0000-0x000001FB27FE0000-memory.dmp
memory/2748-394-0x000001FB28110000-0x000001FB28120000-memory.dmp
memory/2748-393-0x000001FB28060000-0x000001FB28070000-memory.dmp
memory/2748-453-0x000001FB28120000-0x000001FB28130000-memory.dmp
memory/2748-335-0x000001FB280F0000-0x000001FB28100000-memory.dmp
memory/2748-29-0x000001FB26460000-0x000001FB26461000-memory.dmp
memory/2748-456-0x000001FB28130000-0x000001FB28140000-memory.dmp
memory/2748-455-0x000001FB28090000-0x000001FB280A0000-memory.dmp
memory/2748-459-0x000001FB28140000-0x000001FB28150000-memory.dmp
memory/2748-458-0x000001FB280A0000-0x000001FB280B0000-memory.dmp
memory/2748-568-0x000001FB28160000-0x000001FB28170000-memory.dmp
memory/2748-567-0x000001FB28150000-0x000001FB28160000-memory.dmp
memory/2748-566-0x000001FB280B0000-0x000001FB280C0000-memory.dmp
memory/2748-619-0x000001FB280D0000-0x000001FB280E0000-memory.dmp
memory/2748-620-0x000001FB28170000-0x000001FB28180000-memory.dmp
memory/2748-712-0x000001FB28180000-0x000001FB28190000-memory.dmp
memory/2748-711-0x000001FB280E0000-0x000001FB280F0000-memory.dmp
memory/2748-754-0x000001FB28190000-0x000001FB281A0000-memory.dmp
memory/2748-797-0x000001FB281A0000-0x000001FB281B0000-memory.dmp
memory/2748-796-0x000001FB280F0000-0x000001FB28100000-memory.dmp
memory/2748-874-0x000001FB281B0000-0x000001FB281C0000-memory.dmp
memory/2748-873-0x000001FB28100000-0x000001FB28110000-memory.dmp
memory/2748-912-0x000001FB281C0000-0x000001FB281D0000-memory.dmp
memory/2748-911-0x000001FB28110000-0x000001FB28120000-memory.dmp
memory/2748-948-0x000001FB281D0000-0x000001FB281E0000-memory.dmp
memory/2748-947-0x000001FB28120000-0x000001FB28130000-memory.dmp
memory/2748-982-0x000001FB281E0000-0x000001FB281F0000-memory.dmp
memory/2748-981-0x000001FB28130000-0x000001FB28140000-memory.dmp
memory/2748-984-0x000001FB28140000-0x000001FB28150000-memory.dmp
memory/2748-985-0x000001FB281F0000-0x000001FB28200000-memory.dmp
memory/2748-1017-0x000001FB28200000-0x000001FB28210000-memory.dmp
memory/2748-1016-0x000001FB28160000-0x000001FB28170000-memory.dmp
memory/2748-1015-0x000001FB28150000-0x000001FB28160000-memory.dmp
memory/2748-1104-0x000001FB28210000-0x000001FB28220000-memory.dmp
memory/2748-1103-0x000001FB28170000-0x000001FB28180000-memory.dmp
memory/2748-1243-0x000001FB28180000-0x000001FB28190000-memory.dmp
memory/2748-1245-0x000001FB28190000-0x000001FB281A0000-memory.dmp
memory/2748-1246-0x000001FB281A0000-0x000001FB281B0000-memory.dmp
memory/2748-1250-0x000001FB281B0000-0x000001FB281C0000-memory.dmp
memory/2748-1252-0x000001FB281C0000-0x000001FB281D0000-memory.dmp
memory/2748-1254-0x000001FB281D0000-0x000001FB281E0000-memory.dmp
memory/2748-1256-0x000001FB281E0000-0x000001FB281F0000-memory.dmp
memory/2748-1259-0x000001FB281F0000-0x000001FB28200000-memory.dmp
memory/2748-1262-0x000001FB28200000-0x000001FB28210000-memory.dmp
memory/2748-1276-0x000001FB28220000-0x000001FB28230000-memory.dmp
memory/2748-1275-0x000001FB28210000-0x000001FB28220000-memory.dmp
memory/2748-1460-0x000001FB28230000-0x000001FB28240000-memory.dmp
memory/2748-1495-0x000001FB28240000-0x000001FB28250000-memory.dmp
memory/2748-1679-0x000001FB28250000-0x000001FB28260000-memory.dmp
memory/2748-1785-0x000001FB28260000-0x000001FB28270000-memory.dmp
memory/2748-1860-0x000001FB28270000-0x000001FB28280000-memory.dmp
memory/2748-2302-0x000001FB28280000-0x000001FB28290000-memory.dmp
memory/2748-2303-0x000001FB28290000-0x000001FB282A0000-memory.dmp
memory/2748-26-0x000001FB27FC0000-0x000001FB27FD0000-memory.dmp
memory/2748-2487-0x000001FB28220000-0x000001FB28230000-memory.dmp
memory/2748-2627-0x000001FB28230000-0x000001FB28240000-memory.dmp
memory/2748-24-0x000001FB27FB0000-0x000001FB27FC0000-memory.dmp
memory/2748-23-0x000001FB27FA0000-0x000001FB27FB0000-memory.dmp
memory/2748-22-0x000001FB27F90000-0x000001FB27FA0000-memory.dmp
memory/2748-17-0x000001FB27F70000-0x000001FB27F80000-memory.dmp
memory/2748-18-0x000001FB27F80000-0x000001FB27F90000-memory.dmp
memory/2748-2-0x000001FB27D00000-0x000001FB27F70000-memory.dmp