Analysis
- max time kernel
139s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/05/2024, 00:07
General
- Target ClearTrack.jar
- Size 2.5MB
- Sample240528-aee2bsfb31
- SHA256 79e52729e7047c7d4ae1852e597dfbdf0157a918bbe3d3c40497d39e32fa22aa
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\ClearTrack.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3076-2-0x0000024B80000000-0x0000024B80270000-memory.dmp
memory/3076-11-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-19-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-18-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-36-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-52-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-56-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-57-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-73-0x0000024BF0940000-0x0000024BF0941000-memory.dmp
memory/3076-221-0x0000024B80270000-0x0000024B80280000-memory.dmp
memory/3076-220-0x0000024B80000000-0x0000024B80270000-memory.dmp
memory/3076-225-0x0000024B80270000-0x0000024B80280000-memory.dmp