Analysis
- max time kernel
289s - max time network
257s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 23:29
General
- Target meteor-client-0.5.6.jar
- Size 4.3MB
- Sample240613-3gsz7avglc
- SHA256 0058cfe2b24392bb6d84a7cbae10c66ecadfcef47b31e7fa5ad0e8f0b4f71c99
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\meteor-client-0.5.6.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/1072-2-0x000002A1971B0000-0x000002A197420000-memory.dmp
memory/1072-18-0x000002A1959A0000-0x000002A1959A1000-memory.dmp
memory/1072-25-0x000002A197420000-0x000002A197430000-memory.dmp
memory/1072-28-0x000002A197430000-0x000002A197440000-memory.dmp
memory/1072-30-0x000002A197440000-0x000002A197450000-memory.dmp
memory/1072-32-0x000002A197450000-0x000002A197460000-memory.dmp
memory/1072-34-0x000002A197460000-0x000002A197470000-memory.dmp
memory/1072-37-0x000002A197470000-0x000002A197480000-memory.dmp
memory/1072-39-0x000002A197480000-0x000002A197490000-memory.dmp
memory/1072-42-0x000002A1971B0000-0x000002A197420000-memory.dmp
memory/1072-43-0x000002A197490000-0x000002A1974A0000-memory.dmp
memory/1072-45-0x000002A1974A0000-0x000002A1974B0000-memory.dmp
memory/1072-49-0x000002A1974B0000-0x000002A1974C0000-memory.dmp
memory/1072-52-0x000002A1974C0000-0x000002A1974D0000-memory.dmp
memory/1072-51-0x000002A197420000-0x000002A197430000-memory.dmp
memory/1072-55-0x000002A197430000-0x000002A197440000-memory.dmp
memory/1072-56-0x000002A1974D0000-0x000002A1974E0000-memory.dmp
memory/1072-58-0x000002A197440000-0x000002A197450000-memory.dmp
memory/1072-59-0x000002A1974E0000-0x000002A1974F0000-memory.dmp
memory/1072-61-0x000002A197450000-0x000002A197460000-memory.dmp
memory/1072-62-0x000002A1974F0000-0x000002A197500000-memory.dmp
memory/1072-65-0x000002A197460000-0x000002A197470000-memory.dmp
memory/1072-66-0x000002A197500000-0x000002A197510000-memory.dmp
memory/1072-70-0x000002A197470000-0x000002A197480000-memory.dmp
memory/1072-71-0x000002A197510000-0x000002A197520000-memory.dmp
memory/1072-74-0x000002A197480000-0x000002A197490000-memory.dmp
memory/1072-75-0x000002A197520000-0x000002A197530000-memory.dmp
memory/1072-79-0x000002A197490000-0x000002A1974A0000-memory.dmp
memory/1072-80-0x000002A197530000-0x000002A197540000-memory.dmp
memory/1072-81-0x000002A1974A0000-0x000002A1974B0000-memory.dmp
memory/1072-82-0x000002A197540000-0x000002A197550000-memory.dmp
memory/1072-84-0x000002A1974B0000-0x000002A1974C0000-memory.dmp
memory/1072-85-0x000002A197550000-0x000002A197560000-memory.dmp
memory/1072-88-0x000002A1974C0000-0x000002A1974D0000-memory.dmp
memory/1072-90-0x000002A1974D0000-0x000002A1974E0000-memory.dmp
memory/1072-93-0x000002A1974E0000-0x000002A1974F0000-memory.dmp
memory/1072-94-0x000002A197560000-0x000002A197570000-memory.dmp
memory/1072-96-0x000002A1974F0000-0x000002A197500000-memory.dmp
memory/1072-97-0x000002A197570000-0x000002A197580000-memory.dmp
memory/1072-99-0x000002A197500000-0x000002A197510000-memory.dmp
memory/1072-100-0x000002A197580000-0x000002A197590000-memory.dmp
memory/1072-103-0x000002A197510000-0x000002A197520000-memory.dmp
memory/1072-104-0x000002A197520000-0x000002A197530000-memory.dmp
memory/1072-107-0x000002A197530000-0x000002A197540000-memory.dmp
memory/1072-108-0x000002A197540000-0x000002A197550000-memory.dmp
memory/1072-109-0x000002A197550000-0x000002A197560000-memory.dmp
memory/1072-112-0x000002A197560000-0x000002A197570000-memory.dmp
memory/1072-114-0x000002A197570000-0x000002A197580000-memory.dmp
memory/1072-115-0x000002A197580000-0x000002A197590000-memory.dmp
memory/1072-117-0x000002A197590000-0x000002A1975A0000-memory.dmp
memory/1072-127-0x000002A197590000-0x000002A1975A0000-memory.dmp
memory/1072-133-0x000002A1975A0000-0x000002A1975B0000-memory.dmp
memory/1072-135-0x000002A1975B0000-0x000002A1975C0000-memory.dmp
memory/1072-141-0x000002A1975A0000-0x000002A1975B0000-memory.dmp
memory/1072-142-0x000002A1975B0000-0x000002A1975C0000-memory.dmp
memory/1072-147-0x000002A1975C0000-0x000002A1975D0000-memory.dmp
memory/1072-152-0x000002A1975D0000-0x000002A1975E0000-memory.dmp
memory/1072-155-0x000002A1975E0000-0x000002A1975F0000-memory.dmp
memory/1072-160-0x000002A1975C0000-0x000002A1975D0000-memory.dmp
memory/1072-163-0x000002A1975F0000-0x000002A197600000-memory.dmp
memory/1072-162-0x000002A1975D0000-0x000002A1975E0000-memory.dmp
memory/1072-166-0x000002A197600000-0x000002A197610000-memory.dmp
memory/1072-168-0x000002A1975E0000-0x000002A1975F0000-memory.dmp
memory/1072-170-0x000002A1975F0000-0x000002A197600000-memory.dmp
memory/1072-176-0x000002A197610000-0x000002A197620000-memory.dmp
memory/1072-179-0x000002A197620000-0x000002A197630000-memory.dmp
memory/1072-183-0x000002A197630000-0x000002A197640000-memory.dmp
memory/1072-184-0x000002A197640000-0x000002A197650000-memory.dmp
memory/1072-186-0x000002A197610000-0x000002A197620000-memory.dmp
memory/1072-187-0x000002A197620000-0x000002A197630000-memory.dmp
memory/1072-188-0x000002A197630000-0x000002A197640000-memory.dmp
memory/1072-189-0x000002A197640000-0x000002A197650000-memory.dmp