Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 13:57

General

  • Target

    returns.jar

  • Size

    672KB

  • MD5

    e7f87993af6656061d91eb8ac65a2c5e

  • SHA1

    197a771526fec5b516c2aabdd196a6b965db222e

  • SHA256

    f7b4101d747056be7e23e22de55fe93a77ceac5038e1174db9a023d031c80d34

  • SHA512

    6f074fd75e18c64aa5214669dba409a7f043024848c5f949626ff9961035b0ac912fa666a12cf3430ab1899080f056c80b24928e61c44f5688d4c03c0a4d922e

  • SSDEEP

    12288:3k2Pvzp0tHr2/qWSITW1t61Qd0OvZm7Yw97dDs7Y+WqE73nJ0QQU8Wg1IGVd2GEJ:U2HNUHr2/vSIif6NomkgKY+bGJgyG+lJ

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\returns.jar
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3404
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717077432401.tmp" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\system32\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717077432401.tmp" /f
        3⤵
        • Adds Run key to start application
        PID:3656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    7338d7d70115b1e2eb1a9f1aaa06a1e0

    SHA1

    855e068c1b9930348e5da48283e9e3bb71ed10c3

    SHA256

    511c2612564b0244864fde3e87947c6984e5cc100a0106146585dd68002ce3dd

    SHA512

    dd06060e8f2fcd28f184249385a8cbc96018e3ec8ad052a8ae0baaaf3cf072f5a95d971fd02620d14a0d600e8d256ff307fea0542c53d64d5169fdc8a46e8a1e

  • C:\Users\Admin\AppData\Local\Temp\m17170774322601842841552436895069.tmp

    Filesize

    639KB

    MD5

    084cfe9ae1e353f656b978eed500189c

    SHA1

    bd770eb43e4915d396aed1010e6d423668d99164

    SHA256

    46f065657f246571a5c9480680efd2cbe38affebd39c90ba36a165a39b93f881

    SHA512

    17936a3c0aa3ab79482d6da66647d8e5774cb67ccd6ef4186e52185c4cf6b5edbed5877f12ca315c03fa2d6add07c667205d69e8584c51134f20d7e171e50131

  • memory/4460-2-0x000001E5A95E0000-0x000001E5A9850000-memory.dmp

    Filesize

    2.4MB

  • memory/4460-13-0x000001E5A9850000-0x000001E5A9860000-memory.dmp

    Filesize

    64KB

  • memory/4460-16-0x000001E5A9860000-0x000001E5A9870000-memory.dmp

    Filesize

    64KB

  • memory/4460-18-0x000001E5A9870000-0x000001E5A9880000-memory.dmp

    Filesize

    64KB

  • memory/4460-19-0x000001E5A9880000-0x000001E5A9890000-memory.dmp

    Filesize

    64KB

  • memory/4460-21-0x000001E5A9890000-0x000001E5A98A0000-memory.dmp

    Filesize

    64KB

  • memory/4460-25-0x000001E5A95C0000-0x000001E5A95C1000-memory.dmp

    Filesize

    4KB

  • memory/4460-27-0x000001E5A98A0000-0x000001E5A98B0000-memory.dmp

    Filesize

    64KB

  • memory/4460-29-0x000001E5A98B0000-0x000001E5A98C0000-memory.dmp

    Filesize

    64KB

  • memory/4460-32-0x000001E5A98C0000-0x000001E5A98D0000-memory.dmp

    Filesize

    64KB

  • memory/4460-33-0x000001E5A98D0000-0x000001E5A98E0000-memory.dmp

    Filesize

    64KB

  • memory/4460-36-0x000001E5A98E0000-0x000001E5A98F0000-memory.dmp

    Filesize

    64KB

  • memory/4460-39-0x000001E5A95C0000-0x000001E5A95C1000-memory.dmp

    Filesize

    4KB

  • memory/4460-41-0x000001E5A98F0000-0x000001E5A9900000-memory.dmp

    Filesize

    64KB

  • memory/4460-40-0x000001E5A95E0000-0x000001E5A9850000-memory.dmp

    Filesize

    2.4MB

  • memory/4460-44-0x000001E5A9900000-0x000001E5A9910000-memory.dmp

    Filesize

    64KB

  • memory/4460-43-0x000001E5A9850000-0x000001E5A9860000-memory.dmp

    Filesize

    64KB

  • memory/4460-46-0x000001E5A9860000-0x000001E5A9870000-memory.dmp

    Filesize

    64KB

  • memory/4460-47-0x000001E5A9910000-0x000001E5A9920000-memory.dmp

    Filesize

    64KB

  • memory/4460-50-0x000001E5A9920000-0x000001E5A9930000-memory.dmp

    Filesize

    64KB

  • memory/4460-54-0x000001E5A9930000-0x000001E5A9940000-memory.dmp

    Filesize

    64KB

  • memory/4460-55-0x000001E5A9940000-0x000001E5A9950000-memory.dmp

    Filesize

    64KB

  • memory/4460-58-0x000001E5A9890000-0x000001E5A98A0000-memory.dmp

    Filesize

    64KB

  • memory/4460-60-0x000001E5A98A0000-0x000001E5A98B0000-memory.dmp

    Filesize

    64KB

  • memory/4460-61-0x000001E5A9960000-0x000001E5A9970000-memory.dmp

    Filesize

    64KB

  • memory/4460-59-0x000001E5A9950000-0x000001E5A9960000-memory.dmp

    Filesize

    64KB

  • memory/4460-53-0x000001E5A9880000-0x000001E5A9890000-memory.dmp

    Filesize

    64KB

  • memory/4460-49-0x000001E5A9870000-0x000001E5A9880000-memory.dmp

    Filesize

    64KB

  • memory/4460-66-0x000001E5A9980000-0x000001E5A9990000-memory.dmp

    Filesize

    64KB

  • memory/4460-65-0x000001E5A9970000-0x000001E5A9980000-memory.dmp

    Filesize

    64KB

  • memory/4460-70-0x000001E5A9990000-0x000001E5A99A0000-memory.dmp

    Filesize

    64KB

  • memory/4460-69-0x000001E5A98D0000-0x000001E5A98E0000-memory.dmp

    Filesize

    64KB

  • memory/4460-68-0x000001E5A98C0000-0x000001E5A98D0000-memory.dmp

    Filesize

    64KB

  • memory/4460-64-0x000001E5A98B0000-0x000001E5A98C0000-memory.dmp

    Filesize

    64KB

  • memory/4460-73-0x000001E5A99A0000-0x000001E5A99B0000-memory.dmp

    Filesize

    64KB

  • memory/4460-72-0x000001E5A98E0000-0x000001E5A98F0000-memory.dmp

    Filesize

    64KB

  • memory/4460-78-0x000001E5A99B0000-0x000001E5A99C0000-memory.dmp

    Filesize

    64KB

  • memory/4460-77-0x000001E5A98F0000-0x000001E5A9900000-memory.dmp

    Filesize

    64KB

  • memory/4460-85-0x000001E5A99C0000-0x000001E5A99D0000-memory.dmp

    Filesize

    64KB

  • memory/4460-84-0x000001E5A9900000-0x000001E5A9910000-memory.dmp

    Filesize

    64KB

  • memory/4460-88-0x000001E5A99D0000-0x000001E5A99E0000-memory.dmp

    Filesize

    64KB

  • memory/4460-87-0x000001E5A9910000-0x000001E5A9920000-memory.dmp

    Filesize

    64KB

  • memory/4460-96-0x000001E5A99E0000-0x000001E5A99F0000-memory.dmp

    Filesize

    64KB

  • memory/4460-95-0x000001E5A9920000-0x000001E5A9930000-memory.dmp

    Filesize

    64KB

  • memory/4460-98-0x000001E5A9930000-0x000001E5A9940000-memory.dmp

    Filesize

    64KB

  • memory/4460-100-0x000001E5A99F0000-0x000001E5A9A00000-memory.dmp

    Filesize

    64KB

  • memory/4460-99-0x000001E5A9940000-0x000001E5A9950000-memory.dmp

    Filesize

    64KB

  • memory/4460-107-0x000001E5A9A00000-0x000001E5A9A10000-memory.dmp

    Filesize

    64KB

  • memory/4460-106-0x000001E5A9950000-0x000001E5A9960000-memory.dmp

    Filesize

    64KB

  • memory/4460-108-0x000001E5A95C0000-0x000001E5A95C1000-memory.dmp

    Filesize

    4KB

  • memory/4460-110-0x000001E5A9960000-0x000001E5A9970000-memory.dmp

    Filesize

    64KB

  • memory/4460-113-0x000001E5A9980000-0x000001E5A9990000-memory.dmp

    Filesize

    64KB

  • memory/4460-112-0x000001E5A9970000-0x000001E5A9980000-memory.dmp

    Filesize

    64KB

  • memory/4460-114-0x000001E5A9990000-0x000001E5A99A0000-memory.dmp

    Filesize

    64KB

  • memory/4460-115-0x000001E5A99A0000-0x000001E5A99B0000-memory.dmp

    Filesize

    64KB

  • memory/4460-116-0x000001E5A99B0000-0x000001E5A99C0000-memory.dmp

    Filesize

    64KB

  • memory/4460-117-0x000001E5A99C0000-0x000001E5A99D0000-memory.dmp

    Filesize

    64KB

  • memory/4460-118-0x000001E5A99D0000-0x000001E5A99E0000-memory.dmp

    Filesize

    64KB

  • memory/4460-120-0x000001E5A99E0000-0x000001E5A99F0000-memory.dmp

    Filesize

    64KB

  • memory/4460-121-0x000001E5A99F0000-0x000001E5A9A00000-memory.dmp

    Filesize

    64KB

  • memory/4460-122-0x000001E5A9A00000-0x000001E5A9A10000-memory.dmp

    Filesize

    64KB

  • memory/4460-124-0x000001E5A9A10000-0x000001E5A9A20000-memory.dmp

    Filesize

    64KB

  • memory/4460-126-0x000001E5A9A10000-0x000001E5A9A20000-memory.dmp

    Filesize

    64KB

  • memory/4460-130-0x000001E5A9A20000-0x000001E5A9A30000-memory.dmp

    Filesize

    64KB

  • memory/4460-132-0x000001E5A9A40000-0x000001E5A9A50000-memory.dmp

    Filesize

    64KB

  • memory/4460-133-0x000001E5A9A20000-0x000001E5A9A30000-memory.dmp

    Filesize

    64KB