Analysis
- max time kernel
288s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 23:13
General
- Target meteor-client-0.5.0.jar
- Size 4.1MB
- Sample240613-27jzjaybrj
- SHA256 528047bd3be7051a8d34316febd6903b30e0ef537fa26d5cc3dfed1ea24183ba
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\meteor-client-0.5.0.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/1872-2-0x000001D52D9F0000-0x000001D52DC60000-memory.dmp
memory/1872-18-0x000001D52C1F0000-0x000001D52C1F1000-memory.dmp
memory/1872-25-0x000001D52DC60000-0x000001D52DC70000-memory.dmp
memory/1872-27-0x000001D52DC70000-0x000001D52DC80000-memory.dmp
memory/1872-30-0x000001D52DC80000-0x000001D52DC90000-memory.dmp
memory/1872-32-0x000001D52DC90000-0x000001D52DCA0000-memory.dmp
memory/1872-34-0x000001D52DCA0000-0x000001D52DCB0000-memory.dmp
memory/1872-37-0x000001D52DCB0000-0x000001D52DCC0000-memory.dmp
memory/1872-40-0x000001D52DCC0000-0x000001D52DCD0000-memory.dmp
memory/1872-43-0x000001D52D9F0000-0x000001D52DC60000-memory.dmp
memory/1872-44-0x000001D52DCD0000-0x000001D52DCE0000-memory.dmp
memory/1872-46-0x000001D52DCE0000-0x000001D52DCF0000-memory.dmp
memory/1872-50-0x000001D52DCF0000-0x000001D52DD00000-memory.dmp
memory/1872-52-0x000001D52DC60000-0x000001D52DC70000-memory.dmp
memory/1872-53-0x000001D52DD00000-0x000001D52DD10000-memory.dmp
memory/1872-56-0x000001D52DC70000-0x000001D52DC80000-memory.dmp
memory/1872-57-0x000001D52DD10000-0x000001D52DD20000-memory.dmp
memory/1872-59-0x000001D52DC80000-0x000001D52DC90000-memory.dmp
memory/1872-60-0x000001D52DD20000-0x000001D52DD30000-memory.dmp
memory/1872-62-0x000001D52DC90000-0x000001D52DCA0000-memory.dmp
memory/1872-63-0x000001D52DD30000-0x000001D52DD40000-memory.dmp
memory/1872-66-0x000001D52DCA0000-0x000001D52DCB0000-memory.dmp
memory/1872-71-0x000001D52DD40000-0x000001D52DD50000-memory.dmp
memory/1872-70-0x000001D52DCB0000-0x000001D52DCC0000-memory.dmp
memory/1872-74-0x000001D52DD50000-0x000001D52DD60000-memory.dmp
memory/1872-73-0x000001D52DCC0000-0x000001D52DCD0000-memory.dmp
memory/1872-76-0x000001D52DCD0000-0x000001D52DCE0000-memory.dmp
memory/1872-77-0x000001D52DD60000-0x000001D52DD70000-memory.dmp
memory/1872-79-0x000001D52DCE0000-0x000001D52DCF0000-memory.dmp
memory/1872-80-0x000001D52DD70000-0x000001D52DD80000-memory.dmp
memory/1872-82-0x000001D52DCF0000-0x000001D52DD00000-memory.dmp
memory/1872-83-0x000001D52DD80000-0x000001D52DD90000-memory.dmp
memory/1872-85-0x000001D52DD00000-0x000001D52DD10000-memory.dmp
memory/1872-88-0x000001D52DD10000-0x000001D52DD20000-memory.dmp
memory/1872-91-0x000001D52DD20000-0x000001D52DD30000-memory.dmp
memory/1872-92-0x000001D52DD90000-0x000001D52DDA0000-memory.dmp
memory/1872-94-0x000001D52DD30000-0x000001D52DD40000-memory.dmp
memory/1872-95-0x000001D52DDA0000-0x000001D52DDB0000-memory.dmp
memory/1872-97-0x000001D52DDB0000-0x000001D52DDC0000-memory.dmp
memory/1872-100-0x000001D52DD40000-0x000001D52DD50000-memory.dmp
memory/1872-102-0x000001D52DD50000-0x000001D52DD60000-memory.dmp
memory/1872-103-0x000001D52DD60000-0x000001D52DD70000-memory.dmp
memory/1872-104-0x000001D52DDC0000-0x000001D52DDD0000-memory.dmp
memory/1872-107-0x000001D52DD70000-0x000001D52DD80000-memory.dmp
memory/1872-108-0x000001D52DD80000-0x000001D52DD90000-memory.dmp
memory/1872-112-0x000001D52DD90000-0x000001D52DDA0000-memory.dmp
memory/1872-114-0x000001D52DDA0000-0x000001D52DDB0000-memory.dmp
memory/1872-116-0x000001D52DDB0000-0x000001D52DDC0000-memory.dmp
memory/1872-117-0x000001D52DDD0000-0x000001D52DDE0000-memory.dmp
memory/1872-119-0x000001D52DDC0000-0x000001D52DDD0000-memory.dmp
memory/1872-124-0x000001D52C1F0000-0x000001D52C1F1000-memory.dmp
memory/1872-131-0x000001D52DDD0000-0x000001D52DDE0000-memory.dmp
memory/1872-135-0x000001D52DDE0000-0x000001D52DDF0000-memory.dmp
memory/1872-141-0x000001D52DDF0000-0x000001D52DE00000-memory.dmp
memory/1872-143-0x000001D52DDE0000-0x000001D52DDF0000-memory.dmp
memory/1872-146-0x000001D52DE00000-0x000001D52DE10000-memory.dmp
memory/1872-148-0x000001D52DDF0000-0x000001D52DE00000-memory.dmp
memory/1872-151-0x000001D52DE10000-0x000001D52DE20000-memory.dmp
memory/1872-152-0x000001D52DE20000-0x000001D52DE30000-memory.dmp
memory/1872-154-0x000001D52DE30000-0x000001D52DE40000-memory.dmp
memory/1872-159-0x000001D52DE00000-0x000001D52DE10000-memory.dmp
memory/1872-162-0x000001D52DE40000-0x000001D52DE50000-memory.dmp
memory/1872-164-0x000001D52DE10000-0x000001D52DE20000-memory.dmp
memory/1872-165-0x000001D52DE20000-0x000001D52DE30000-memory.dmp
memory/1872-166-0x000001D52DE30000-0x000001D52DE40000-memory.dmp
memory/1872-169-0x000001D52DE50000-0x000001D52DE60000-memory.dmp
memory/1872-170-0x000001D52DE40000-0x000001D52DE50000-memory.dmp
memory/1872-176-0x000001D52DE60000-0x000001D52DE70000-memory.dmp
memory/1872-179-0x000001D52DE70000-0x000001D52DE80000-memory.dmp
memory/1872-184-0x000001D52DE80000-0x000001D52DE90000-memory.dmp
memory/1872-187-0x000001D52DE90000-0x000001D52DEA0000-memory.dmp
memory/1872-188-0x000001D52DE60000-0x000001D52DE70000-memory.dmp
memory/1872-189-0x000001D52DE70000-0x000001D52DE80000-memory.dmp
memory/1872-190-0x000001D52DE80000-0x000001D52DE90000-memory.dmp
memory/1872-191-0x000001D52DE90000-0x000001D52DEA0000-memory.dmp