f7aecc3483791b791ecf37f09229e3b363d1f82cd52321ca582e62030f03f53b

Analysis

max time kernel
146s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
monkeyninja.jar
Size 654KB
Sample240612-vrrk4sserd
SHA256 f7aecc3483791b791ecf37f09229e3b363d1f82cd52321ca582e62030f03f53b
MD5 81f0f1487650ad33d711160d12c661f9
SHA1 a0189254d6ec8312a0f9d4508e2bbee8a7006bf0
SHA512 e28c8244e7cb38e382e874d640af97607e53b0d47afdfeaef5c1be52d3e38b8a46d47cefa898821e3cbe03f04488b9f3247c21a9cb6539df8623b672500618e2
SSDEEP 12288:MXXTQH/pdXu5d4FLEL6ngq/fR3+9NgNmfcgO1SRfO3kuo2ZMSkZDAY:MXDQfDuv4JbngqBWomfhoNkuFZPkZDAY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4688	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1718212431333.tmp"	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
400	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4688	400	java.exe	92
PID 400 wrote to memory of 4688	400	java.exe	92
PID 400 wrote to memory of 2760	400	java.exe	95
PID 400 wrote to memory of 2760	400	java.exe	95
PID 400 wrote to memory of 3756	400	java.exe	97
PID 400 wrote to memory of 3756	400	java.exe	97
PID 3756 wrote to memory of 2296	3756	cmd.exe	99
PID 3756 wrote to memory of 2296	3756	cmd.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2760	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\monkeyninja.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4688
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1718212431333.tmp
  2⤵
  - Views/modifies file attributes
  PID:2760
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1718212431333.tmp" /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1718212431333.tmp" /f
    3⤵
    - Adds Run key to start application
    PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 43df1836bc2cd7deae4d2dfc3ce9f42464741e2d0a11b535c3f65ea7023a6c40
MD5 36f1910c048c87e419a0cb5ac333661e
SHA1 fee6fb56673554acb41dbfb9a1c2c0c0adf665ad
SHA512 b8cb66d35dfc9940342363ffdf14fb5019179427403d5229709b67dbc5fb9827f78be8f1b7d080dd1747b5890f47530dd1d35783b6658f33284f1ded2019a970
MD5 SHA1 SHA512

Submit Download

1718212431333.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1718212431333.tmp
Size 654KB
SHA256 f7aecc3483791b791ecf37f09229e3b363d1f82cd52321ca582e62030f03f53b
MD5 81f0f1487650ad33d711160d12c661f9
SHA1 a0189254d6ec8312a0f9d4508e2bbee8a7006bf0
SHA512 e28c8244e7cb38e382e874d640af97607e53b0d47afdfeaef5c1be52d3e38b8a46d47cefa898821e3cbe03f04488b9f3247c21a9cb6539df8623b672500618e2
SSDEEP 12288:MXXTQH/pdXu5d4FLEL6ngq/fR3+9NgNmfcgO1SRfO3kuo2ZMSkZDAY:MXDQfDuv4JbngqBWomfhoNkuFZPkZDAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-44-0x00000225B13C0000-0x00000225B1630000-memory.dmp

Download

memory/400-56-0x00000225B16C0000-0x00000225B16D0000-memory.dmp

Download

memory/400-20-0x00000225B1650000-0x00000225B1660000-memory.dmp

Download

memory/400-25-0x00000225B1670000-0x00000225B1680000-memory.dmp

Download

memory/400-46-0x00000225B1630000-0x00000225B1640000-memory.dmp

Download

memory/400-26-0x00000225B1680000-0x00000225B1690000-memory.dmp

Download

memory/400-28-0x00000225B1690000-0x00000225B16A0000-memory.dmp

Download

memory/400-31-0x00000225B16A0000-0x00000225B16B0000-memory.dmp

Download

memory/400-18-0x00000225B1640000-0x00000225B1650000-memory.dmp

Download

memory/400-36-0x00000225B16B0000-0x00000225B16C0000-memory.dmp

Download

memory/400-37-0x00000225AFBA0000-0x00000225AFBA1000-memory.dmp

Download

memory/400-41-0x00000225B16C0000-0x00000225B16D0000-memory.dmp

Download

memory/400-17-0x00000225B1630000-0x00000225B1640000-memory.dmp

Download

memory/400-2-0x00000225B13C0000-0x00000225B1630000-memory.dmp

Download

memory/400-24-0x00000225B1660000-0x00000225B1670000-memory.dmp

Download

memory/400-47-0x00000225B1650000-0x00000225B1660000-memory.dmp

Download

memory/400-48-0x00000225B1660000-0x00000225B1670000-memory.dmp

Download

memory/400-50-0x00000225B1670000-0x00000225B1680000-memory.dmp

Download

memory/400-51-0x00000225B1680000-0x00000225B1690000-memory.dmp

Download

memory/400-52-0x00000225B1690000-0x00000225B16A0000-memory.dmp

Download

memory/400-53-0x00000225B16A0000-0x00000225B16B0000-memory.dmp

Download

memory/400-54-0x00000225B16D0000-0x00000225B16E0000-memory.dmp

Download

memory/400-55-0x00000225B16B0000-0x00000225B16C0000-memory.dmp

Download

memory/400-45-0x00000225B1640000-0x00000225B1650000-memory.dmp

Download

memory/400-57-0x00000225B16D0000-0x00000225B16E0000-memory.dmp

Download

memory/400-60-0x00000225B16E0000-0x00000225B16F0000-memory.dmp

Download

memory/400-62-0x00000225B16E0000-0x00000225B16F0000-memory.dmp

Download

memory/400-64-0x00000225B16F0000-0x00000225B1700000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads