Analysis
- max time kernel
1797s - max time network
1799s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
05/06/2024, 17:35
General
- Target Cool.jar
- Size 639KB
- Sample240605-v6evvsdb2w
- SHA256 3a8cbe3afe2da35bb109fee0c7df0c503ad6733e0e2bbf0910768819ef9123e7
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Cool.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609258483.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609258483.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609258483.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1717609258483.tmp
memory/4616-2-0x00000204292D0000-0x0000020429540000-memory.dmp
memory/4616-16-0x0000020429540000-0x0000020429550000-memory.dmp
memory/4616-19-0x0000020429550000-0x0000020429560000-memory.dmp
memory/4616-20-0x0000020429560000-0x0000020429570000-memory.dmp
memory/4616-23-0x0000020429570000-0x0000020429580000-memory.dmp
memory/4616-24-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-25-0x0000020429580000-0x0000020429590000-memory.dmp
memory/4616-28-0x0000020429590000-0x00000204295A0000-memory.dmp
memory/4616-29-0x00000204295A0000-0x00000204295B0000-memory.dmp
memory/4616-34-0x00000204295B0000-0x00000204295C0000-memory.dmp
memory/4616-36-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-38-0x00000204292D0000-0x0000020429540000-memory.dmp
memory/4616-39-0x0000020429540000-0x0000020429550000-memory.dmp
memory/4616-41-0x0000020429560000-0x0000020429570000-memory.dmp
memory/4616-40-0x0000020429550000-0x0000020429560000-memory.dmp
memory/4616-42-0x0000020429570000-0x0000020429580000-memory.dmp
memory/4616-43-0x0000020429580000-0x0000020429590000-memory.dmp
memory/4616-46-0x0000020429590000-0x00000204295A0000-memory.dmp
memory/4616-47-0x00000204295A0000-0x00000204295B0000-memory.dmp
memory/4616-49-0x00000204295C0000-0x00000204295D0000-memory.dmp
memory/4616-48-0x00000204295B0000-0x00000204295C0000-memory.dmp
memory/4616-50-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-51-0x00000204295C0000-0x00000204295D0000-memory.dmp
memory/4616-53-0x00000204295D0000-0x00000204295E0000-memory.dmp
memory/4616-56-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-57-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-65-0x00000204295E0000-0x00000204295F0000-memory.dmp
memory/4616-68-0x00000204295E0000-0x00000204295F0000-memory.dmp
memory/4616-72-0x00000204295F0000-0x0000020429600000-memory.dmp
memory/4616-76-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-77-0x00000204295F0000-0x0000020429600000-memory.dmp
memory/4616-82-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-86-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-93-0x0000020429600000-0x0000020429610000-memory.dmp
memory/4616-94-0x0000020429610000-0x0000020429620000-memory.dmp
memory/4616-96-0x0000020429600000-0x0000020429610000-memory.dmp
memory/4616-98-0x0000020429620000-0x0000020429630000-memory.dmp
memory/4616-102-0x0000020429620000-0x0000020429630000-memory.dmp
memory/4616-105-0x0000020429630000-0x0000020429640000-memory.dmp
memory/4616-106-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-109-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-111-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-121-0x0000020429630000-0x0000020429640000-memory.dmp
memory/4616-122-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-127-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-128-0x0000020429640000-0x0000020429650000-memory.dmp
memory/4616-134-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-136-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-139-0x00000204292B0000-0x00000204292B1000-memory.dmp
memory/4616-140-0x0000020429650000-0x0000020429660000-memory.dmp
memory/4616-151-0x0000020429640000-0x0000020429650000-memory.dmp
memory/4616-158-0x0000020429650000-0x0000020429660000-memory.dmp
memory/4616-382-0x0000020429660000-0x0000020429670000-memory.dmp
memory/4616-389-0x0000020429660000-0x0000020429670000-memory.dmp
memory/4616-390-0x0000020429670000-0x0000020429680000-memory.dmp
memory/4616-402-0x0000020429670000-0x0000020429680000-memory.dmp
memory/4616-451-0x0000020429680000-0x0000020429690000-memory.dmp
memory/4616-462-0x0000020429680000-0x0000020429690000-memory.dmp
memory/4616-530-0x0000020429690000-0x00000204296A0000-memory.dmp
memory/4616-557-0x0000020429690000-0x00000204296A0000-memory.dmp
memory/4616-659-0x00000204296A0000-0x00000204296B0000-memory.dmp
memory/4616-774-0x00000204296B0000-0x00000204296C0000-memory.dmp
memory/4616-787-0x00000204296B0000-0x00000204296C0000-memory.dmp
memory/4616-904-0x00000204296C0000-0x00000204296D0000-memory.dmp
memory/4616-993-0x00000204296D0000-0x00000204296E0000-memory.dmp
memory/4616-1069-0x00000204296E0000-0x00000204296F0000-memory.dmp
memory/4616-1092-0x00000204296D0000-0x00000204296E0000-memory.dmp
memory/4616-1093-0x00000204296E0000-0x00000204296F0000-memory.dmp