Analysis
- max time kernel
1795s - max time network
1801s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
05/06/2024, 17:35
General
- Target Cool.jar
- Size 639KB
- Sample240605-v6db2aea76
- SHA256 3a8cbe3afe2da35bb109fee0c7df0c503ad6733e0e2bbf0910768819ef9123e7
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Cool.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610081431.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610081431.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610081431.tmp" /f3⤵
- Adds Run key to start application
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4276,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1717610081431.tmp
memory/4400-2-0x000002ADB3280000-0x000002ADB34F0000-memory.dmp
memory/4400-18-0x000002ADB3500000-0x000002ADB3510000-memory.dmp
memory/4400-17-0x000002ADB34F0000-0x000002ADB3500000-memory.dmp
memory/4400-20-0x000002ADB3510000-0x000002ADB3520000-memory.dmp
memory/4400-23-0x000002ADB3520000-0x000002ADB3530000-memory.dmp
memory/4400-25-0x000002ADB3530000-0x000002ADB3540000-memory.dmp
memory/4400-28-0x000002ADB3550000-0x000002ADB3560000-memory.dmp
memory/4400-27-0x000002ADB3540000-0x000002ADB3550000-memory.dmp
memory/4400-30-0x000002ADB3560000-0x000002ADB3570000-memory.dmp
memory/4400-33-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-36-0x000002ADB3570000-0x000002ADB3580000-memory.dmp
memory/4400-40-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-42-0x000002ADB3580000-0x000002ADB3590000-memory.dmp
memory/4400-44-0x000002ADB3280000-0x000002ADB34F0000-memory.dmp
memory/4400-47-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-49-0x000002ADB3500000-0x000002ADB3510000-memory.dmp
memory/4400-48-0x000002ADB34F0000-0x000002ADB3500000-memory.dmp
memory/4400-51-0x000002ADB3510000-0x000002ADB3520000-memory.dmp
memory/4400-52-0x000002ADB3520000-0x000002ADB3530000-memory.dmp
memory/4400-53-0x000002ADB3530000-0x000002ADB3540000-memory.dmp
memory/4400-55-0x000002ADB3550000-0x000002ADB3560000-memory.dmp
memory/4400-54-0x000002ADB3540000-0x000002ADB3550000-memory.dmp
memory/4400-56-0x000002ADB3560000-0x000002ADB3570000-memory.dmp
memory/4400-57-0x000002ADB3570000-0x000002ADB3580000-memory.dmp
memory/4400-58-0x000002ADB3580000-0x000002ADB3590000-memory.dmp
memory/4400-64-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-65-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-70-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-71-0x000002ADB3590000-0x000002ADB35A0000-memory.dmp
memory/4400-77-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-81-0x000002ADB3590000-0x000002ADB35A0000-memory.dmp
memory/4400-90-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-95-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-110-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-111-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-112-0x000002ADB35A0000-0x000002ADB35B0000-memory.dmp
memory/4400-113-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-116-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-118-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-123-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-133-0x000002ADB35A0000-0x000002ADB35B0000-memory.dmp
memory/4400-143-0x000002ADB35B0000-0x000002ADB35C0000-memory.dmp
memory/4400-146-0x000002ADB35C0000-0x000002ADB35D0000-memory.dmp
memory/4400-151-0x000002ADB35D0000-0x000002ADB35E0000-memory.dmp
memory/4400-153-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-158-0x000002ADB35C0000-0x000002ADB35D0000-memory.dmp
memory/4400-159-0x000002ADB35D0000-0x000002ADB35E0000-memory.dmp
memory/4400-161-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-164-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-166-0x000002ADB35E0000-0x000002ADB35F0000-memory.dmp
memory/4400-167-0x000002ADB19C0000-0x000002ADB19C1000-memory.dmp
memory/4400-172-0x000002ADB35E0000-0x000002ADB35F0000-memory.dmp
memory/4400-180-0x000002ADB35F0000-0x000002ADB3600000-memory.dmp
memory/4400-244-0x000002ADB3600000-0x000002ADB3610000-memory.dmp
memory/4400-351-0x000002ADB3610000-0x000002ADB3620000-memory.dmp
memory/4400-377-0x000002ADB3610000-0x000002ADB3620000-memory.dmp
memory/4400-539-0x000002ADB3620000-0x000002ADB3630000-memory.dmp
memory/4400-634-0x000002ADB3630000-0x000002ADB3640000-memory.dmp
memory/4400-698-0x000002ADB3620000-0x000002ADB3630000-memory.dmp
memory/4400-759-0x000002ADB3630000-0x000002ADB3640000-memory.dmp
memory/4400-801-0x000002ADB3640000-0x000002ADB3650000-memory.dmp
memory/4400-861-0x000002ADB3650000-0x000002ADB3660000-memory.dmp
memory/4400-942-0x000002ADB3640000-0x000002ADB3650000-memory.dmp
memory/4400-943-0x000002ADB3660000-0x000002ADB3670000-memory.dmp
memory/4400-1027-0x000002ADB3680000-0x000002ADB3690000-memory.dmp
memory/4400-1028-0x000002ADB3650000-0x000002ADB3660000-memory.dmp
memory/4400-1043-0x000002ADB3660000-0x000002ADB3670000-memory.dmp
memory/4400-1095-0x000002ADB3670000-0x000002ADB3680000-memory.dmp
memory/4400-1166-0x000002ADB3680000-0x000002ADB3690000-memory.dmp
memory/4400-1168-0x000002ADB3670000-0x000002ADB3680000-memory.dmp
memory/4400-1174-0x000002ADB3690000-0x000002ADB36A0000-memory.dmp
memory/4400-1185-0x000002ADB3690000-0x000002ADB36A0000-memory.dmp
memory/4400-1195-0x000002ADB36A0000-0x000002ADB36B0000-memory.dmp
memory/4400-1205-0x000002ADB36A0000-0x000002ADB36B0000-memory.dmp
memory/4400-1257-0x000002ADB36B0000-0x000002ADB36C0000-memory.dmp
memory/4400-1265-0x000002ADB36B0000-0x000002ADB36C0000-memory.dmp
memory/4400-1284-0x000002ADB36C0000-0x000002ADB36D0000-memory.dmp
memory/4400-1295-0x000002ADB36C0000-0x000002ADB36D0000-memory.dmp
memory/4400-1370-0x000002ADB36D0000-0x000002ADB36E0000-memory.dmp
memory/4400-1600-0x000002ADB36E0000-0x000002ADB36F0000-memory.dmp
memory/4400-1603-0x000002ADB36F0000-0x000002ADB3700000-memory.dmp
memory/4400-1635-0x000002ADB3700000-0x000002ADB3710000-memory.dmp
memory/4400-1670-0x000002ADB36E0000-0x000002ADB36F0000-memory.dmp
memory/4400-1671-0x000002ADB36F0000-0x000002ADB3700000-memory.dmp
memory/4400-1672-0x000002ADB3700000-0x000002ADB3710000-memory.dmp