Analysis
- max time kernel
1792s - max time network
1799s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
05/06/2024, 17:35
General
- Target Cool.jar
- Size 639KB
- Sample240605-v6db2aea76
- SHA256 3a8cbe3afe2da35bb109fee0c7df0c503ad6733e0e2bbf0910768819ef9123e7
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Cool.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610102109.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610102109.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717610102109.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1717610102109.tmp
memory/3484-2-0x0000015632680000-0x00000156328F0000-memory.dmp
memory/3484-17-0x00000156328F0000-0x0000015632900000-memory.dmp
memory/3484-18-0x0000015632900000-0x0000015632910000-memory.dmp
memory/3484-20-0x0000015632910000-0x0000015632920000-memory.dmp
memory/3484-23-0x0000015632920000-0x0000015632930000-memory.dmp
memory/3484-24-0x0000015632930000-0x0000015632940000-memory.dmp
memory/3484-26-0x0000015632940000-0x0000015632950000-memory.dmp
memory/3484-28-0x0000015632950000-0x0000015632960000-memory.dmp
memory/3484-31-0x0000015632960000-0x0000015632970000-memory.dmp
memory/3484-34-0x0000015632970000-0x0000015632980000-memory.dmp
memory/3484-39-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-41-0x0000015632680000-0x00000156328F0000-memory.dmp
memory/3484-42-0x0000015632980000-0x0000015632990000-memory.dmp
memory/3484-43-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-47-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-48-0x00000156328F0000-0x0000015632900000-memory.dmp
memory/3484-49-0x0000015632900000-0x0000015632910000-memory.dmp
memory/3484-50-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-51-0x0000015632910000-0x0000015632920000-memory.dmp
memory/3484-52-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-55-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-56-0x0000015632920000-0x0000015632930000-memory.dmp
memory/3484-58-0x0000015632930000-0x0000015632940000-memory.dmp
memory/3484-59-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-62-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-63-0x0000015632940000-0x0000015632950000-memory.dmp
memory/3484-65-0x0000015632950000-0x0000015632960000-memory.dmp
memory/3484-67-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-71-0x0000015632960000-0x0000015632970000-memory.dmp
memory/3484-73-0x0000015632970000-0x0000015632980000-memory.dmp
memory/3484-79-0x0000015632980000-0x0000015632990000-memory.dmp
memory/3484-80-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-88-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-90-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-95-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-102-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-107-0x0000015632990000-0x00000156329A0000-memory.dmp
memory/3484-116-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-118-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-126-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-128-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-132-0x0000015632990000-0x00000156329A0000-memory.dmp
memory/3484-144-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-150-0x00000156329A0000-0x00000156329B0000-memory.dmp
memory/3484-153-0x0000015630D90000-0x0000015630D91000-memory.dmp
memory/3484-159-0x00000156329A0000-0x00000156329B0000-memory.dmp
memory/3484-170-0x00000156329B0000-0x00000156329C0000-memory.dmp
memory/3484-180-0x00000156329B0000-0x00000156329C0000-memory.dmp
memory/3484-189-0x00000156329C0000-0x00000156329D0000-memory.dmp
memory/3484-190-0x00000156329E0000-0x00000156329F0000-memory.dmp
memory/3484-196-0x00000156329E0000-0x00000156329F0000-memory.dmp
memory/3484-209-0x00000156329F0000-0x0000015632A00000-memory.dmp
memory/3484-211-0x0000015632A00000-0x0000015632A10000-memory.dmp
memory/3484-218-0x00000156329F0000-0x0000015632A00000-memory.dmp
memory/3484-224-0x0000015632A00000-0x0000015632A10000-memory.dmp
memory/3484-405-0x0000015632A10000-0x0000015632A20000-memory.dmp
memory/3484-433-0x0000015632A10000-0x0000015632A20000-memory.dmp
memory/3484-459-0x0000015632A20000-0x0000015632A30000-memory.dmp
memory/3484-654-0x0000015632A30000-0x0000015632A40000-memory.dmp
memory/3484-705-0x0000015632A30000-0x0000015632A40000-memory.dmp
memory/3484-852-0x0000015632A40000-0x0000015632A50000-memory.dmp
memory/3484-941-0x0000015632A40000-0x0000015632A50000-memory.dmp
memory/3484-946-0x0000015632A50000-0x0000015632A60000-memory.dmp
memory/3484-951-0x0000015632A50000-0x0000015632A60000-memory.dmp
memory/3484-966-0x0000015632A60000-0x0000015632A70000-memory.dmp
memory/3484-976-0x0000015632A60000-0x0000015632A70000-memory.dmp
memory/3484-1057-0x0000015632A70000-0x0000015632A80000-memory.dmp
memory/3484-1061-0x0000015632A70000-0x0000015632A80000-memory.dmp
memory/3484-1089-0x0000015632A80000-0x0000015632A90000-memory.dmp
memory/3484-1103-0x0000015632A80000-0x0000015632A90000-memory.dmp
memory/3484-1155-0x0000015632A90000-0x0000015632AA0000-memory.dmp
memory/3484-1313-0x0000015632AB0000-0x0000015632AC0000-memory.dmp
memory/3484-1330-0x0000015632AA0000-0x0000015632AB0000-memory.dmp
memory/3484-1351-0x0000015632AB0000-0x0000015632AC0000-memory.dmp
memory/3484-1352-0x0000015632AA0000-0x0000015632AB0000-memory.dmp
memory/3484-1396-0x0000015632AC0000-0x0000015632AD0000-memory.dmp
memory/3484-1416-0x0000015632AC0000-0x0000015632AD0000-memory.dmp
memory/3484-1426-0x0000015632AD0000-0x0000015632AE0000-memory.dmp
memory/3484-1438-0x0000015632AE0000-0x0000015632AF0000-memory.dmp
memory/3484-1443-0x0000015632AD0000-0x0000015632AE0000-memory.dmp