Analysis
- max time kernel
1799s - max time network
1800s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
05/06/2024, 17:35
General
- Target Cool.jar
- Size 639KB
- Sample240605-v6evvsdb2w
- SHA256 3a8cbe3afe2da35bb109fee0c7df0c503ad6733e0e2bbf0910768819ef9123e7
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Cool.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609265523.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609265523.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1717609265523.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1717609265523.tmp
memory/3160-2-0x0000013193E50000-0x00000131940C0000-memory.dmp
memory/3160-17-0x00000131940C0000-0x00000131940D0000-memory.dmp
memory/3160-18-0x00000131940D0000-0x00000131940E0000-memory.dmp
memory/3160-20-0x00000131940E0000-0x00000131940F0000-memory.dmp
memory/3160-22-0x00000131940F0000-0x0000013194100000-memory.dmp
memory/3160-24-0x0000013194100000-0x0000013194110000-memory.dmp
memory/3160-25-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-28-0x0000013194110000-0x0000013194120000-memory.dmp
memory/3160-31-0x0000013194120000-0x0000013194130000-memory.dmp
memory/3160-33-0x0000013194130000-0x0000013194140000-memory.dmp
memory/3160-36-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-38-0x0000013193E50000-0x00000131940C0000-memory.dmp
memory/3160-39-0x00000131940C0000-0x00000131940D0000-memory.dmp
memory/3160-40-0x00000131940D0000-0x00000131940E0000-memory.dmp
memory/3160-41-0x00000131940E0000-0x00000131940F0000-memory.dmp
memory/3160-42-0x00000131940F0000-0x0000013194100000-memory.dmp
memory/3160-43-0x0000013194100000-0x0000013194110000-memory.dmp
memory/3160-44-0x0000013194110000-0x0000013194120000-memory.dmp
memory/3160-49-0x0000013194140000-0x0000013194150000-memory.dmp
memory/3160-48-0x0000013194120000-0x0000013194130000-memory.dmp
memory/3160-50-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-51-0x0000013194130000-0x0000013194140000-memory.dmp
memory/3160-52-0x0000013194150000-0x0000013194160000-memory.dmp
memory/3160-55-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-56-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-64-0x0000013194160000-0x0000013194170000-memory.dmp
memory/3160-66-0x0000013194160000-0x0000013194170000-memory.dmp
memory/3160-69-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-70-0x0000013194170000-0x0000013194180000-memory.dmp
memory/3160-72-0x0000013194170000-0x0000013194180000-memory.dmp
memory/3160-76-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-80-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-83-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-85-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-88-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-90-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-109-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-118-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-129-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-132-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-134-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-139-0x0000013194180000-0x0000013194190000-memory.dmp
memory/3160-140-0x00000131925E0000-0x00000131925E1000-memory.dmp
memory/3160-169-0x0000013194180000-0x0000013194190000-memory.dmp
memory/3160-200-0x00000131941A0000-0x00000131941B0000-memory.dmp
memory/3160-199-0x0000013194190000-0x00000131941A0000-memory.dmp
memory/3160-218-0x00000131941B0000-0x00000131941C0000-memory.dmp
memory/3160-224-0x0000013194190000-0x00000131941A0000-memory.dmp
memory/3160-225-0x00000131941A0000-0x00000131941B0000-memory.dmp
memory/3160-232-0x00000131941B0000-0x00000131941C0000-memory.dmp
memory/3160-278-0x00000131941C0000-0x00000131941D0000-memory.dmp
memory/3160-303-0x00000131941C0000-0x00000131941D0000-memory.dmp
memory/3160-406-0x00000131941D0000-0x00000131941E0000-memory.dmp
memory/3160-423-0x00000131941D0000-0x00000131941E0000-memory.dmp
memory/3160-542-0x00000131941E0000-0x00000131941F0000-memory.dmp
memory/3160-570-0x00000131941F0000-0x0000013194200000-memory.dmp
memory/3160-577-0x00000131941F0000-0x0000013194200000-memory.dmp
memory/3160-604-0x0000013194200000-0x0000013194210000-memory.dmp
memory/3160-615-0x0000013194200000-0x0000013194210000-memory.dmp
memory/3160-729-0x0000013194210000-0x0000013194220000-memory.dmp
memory/3160-759-0x0000013194210000-0x0000013194220000-memory.dmp
memory/3160-812-0x0000013194220000-0x0000013194230000-memory.dmp
memory/3160-838-0x0000013194220000-0x0000013194230000-memory.dmp
memory/3160-881-0x0000013194230000-0x0000013194240000-memory.dmp
memory/3160-1055-0x0000013194230000-0x0000013194240000-memory.dmp
memory/3160-1056-0x0000013194240000-0x0000013194250000-memory.dmp
memory/3160-1131-0x0000013194250000-0x0000013194260000-memory.dmp
memory/3160-1150-0x0000013194240000-0x0000013194250000-memory.dmp
memory/3160-1170-0x0000013194260000-0x0000013194270000-memory.dmp
memory/3160-1275-0x0000013194250000-0x0000013194260000-memory.dmp
memory/3160-1302-0x0000013194260000-0x0000013194270000-memory.dmp
memory/3160-1397-0x0000013194270000-0x0000013194280000-memory.dmp