Analysis
- max time kernel
146s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20240611-en - resource tags
- submitted
25/06/2024, 13:21
General
- Target NOIDEA.jar
- Size 2.3MB
- Sample240625-qlrlpsvflq
- SHA256 a44882003aae3c833f7540e12b9db89240b5f02669949e72cdc600485135e511
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\NOIDEA.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321683304.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321683304.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321683304.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1719321683304.tmp
memory/3636-2-0x000001ADCEDB0000-0x000001ADCF020000-memory.dmp
memory/3636-18-0x000001ADCF030000-0x000001ADCF040000-memory.dmp
memory/3636-17-0x000001ADCF020000-0x000001ADCF030000-memory.dmp
memory/3636-23-0x000001ADCF050000-0x000001ADCF060000-memory.dmp
memory/3636-22-0x000001ADCF040000-0x000001ADCF050000-memory.dmp
memory/3636-26-0x000001ADCF070000-0x000001ADCF080000-memory.dmp
memory/3636-24-0x000001ADCF060000-0x000001ADCF070000-memory.dmp
memory/3636-28-0x000001ADCF080000-0x000001ADCF090000-memory.dmp
memory/3636-30-0x000001ADCF090000-0x000001ADCF0A0000-memory.dmp
memory/3636-36-0x000001ADCF0A0000-0x000001ADCF0B0000-memory.dmp
memory/3636-39-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-41-0x000001ADCF0B0000-0x000001ADCF0C0000-memory.dmp
memory/3636-45-0x000001ADCF0C0000-0x000001ADCF0D0000-memory.dmp
memory/3636-46-0x000001ADCF0D0000-0x000001ADCF0E0000-memory.dmp
memory/3636-43-0x000001ADCEDB0000-0x000001ADCF020000-memory.dmp
memory/3636-51-0x000001ADCF100000-0x000001ADCF110000-memory.dmp
memory/3636-50-0x000001ADCF0F0000-0x000001ADCF100000-memory.dmp
memory/3636-49-0x000001ADCF0E0000-0x000001ADCF0F0000-memory.dmp
memory/3636-56-0x000001ADCF110000-0x000001ADCF120000-memory.dmp
memory/3636-55-0x000001ADCF030000-0x000001ADCF040000-memory.dmp
memory/3636-54-0x000001ADCF020000-0x000001ADCF030000-memory.dmp
memory/3636-60-0x000001ADCF050000-0x000001ADCF060000-memory.dmp
memory/3636-70-0x000001ADCF150000-0x000001ADCF160000-memory.dmp
memory/3636-71-0x000001ADCF160000-0x000001ADCF170000-memory.dmp
memory/3636-69-0x000001ADCF070000-0x000001ADCF080000-memory.dmp
memory/3636-63-0x000001ADCF140000-0x000001ADCF150000-memory.dmp
memory/3636-65-0x000001ADCF130000-0x000001ADCF140000-memory.dmp
memory/3636-72-0x000001ADCF170000-0x000001ADCF180000-memory.dmp
memory/3636-75-0x000001ADCF080000-0x000001ADCF090000-memory.dmp
memory/3636-64-0x000001ADCF060000-0x000001ADCF070000-memory.dmp
memory/3636-76-0x000001ADCF180000-0x000001ADCF190000-memory.dmp
memory/3636-62-0x000001ADCF120000-0x000001ADCF130000-memory.dmp
memory/3636-59-0x000001ADCF040000-0x000001ADCF050000-memory.dmp
memory/3636-79-0x000001ADCF090000-0x000001ADCF0A0000-memory.dmp
memory/3636-80-0x000001ADCF190000-0x000001ADCF1A0000-memory.dmp
memory/3636-85-0x000001ADCF0A0000-0x000001ADCF0B0000-memory.dmp
memory/3636-86-0x000001ADCF1A0000-0x000001ADCF1B0000-memory.dmp
memory/3636-91-0x000001ADCF1B0000-0x000001ADCF1C0000-memory.dmp
memory/3636-90-0x000001ADCF0D0000-0x000001ADCF0E0000-memory.dmp
memory/3636-89-0x000001ADCF0B0000-0x000001ADCF0C0000-memory.dmp
memory/3636-93-0x000001ADCF0C0000-0x000001ADCF0D0000-memory.dmp
memory/3636-94-0x000001ADCF1C0000-0x000001ADCF1D0000-memory.dmp
memory/3636-101-0x000001ADCF1D0000-0x000001ADCF1E0000-memory.dmp
memory/3636-100-0x000001ADCF100000-0x000001ADCF110000-memory.dmp
memory/3636-99-0x000001ADCF0F0000-0x000001ADCF100000-memory.dmp
memory/3636-98-0x000001ADCF0E0000-0x000001ADCF0F0000-memory.dmp
memory/3636-104-0x000001ADCF110000-0x000001ADCF120000-memory.dmp
memory/3636-106-0x000001ADCF1F0000-0x000001ADCF200000-memory.dmp
memory/3636-105-0x000001ADCF1E0000-0x000001ADCF1F0000-memory.dmp
memory/3636-110-0x000001ADCF120000-0x000001ADCF130000-memory.dmp
memory/3636-115-0x000001ADCF130000-0x000001ADCF140000-memory.dmp
memory/3636-114-0x000001ADCF220000-0x000001ADCF230000-memory.dmp
memory/3636-113-0x000001ADCF210000-0x000001ADCF220000-memory.dmp
memory/3636-112-0x000001ADCF200000-0x000001ADCF210000-memory.dmp
memory/3636-111-0x000001ADCF140000-0x000001ADCF150000-memory.dmp
memory/3636-118-0x000001ADCF150000-0x000001ADCF160000-memory.dmp
memory/3636-121-0x000001ADCF230000-0x000001ADCF240000-memory.dmp
memory/3636-120-0x000001ADCF170000-0x000001ADCF180000-memory.dmp
memory/3636-119-0x000001ADCF160000-0x000001ADCF170000-memory.dmp
memory/3636-124-0x000001ADCF240000-0x000001ADCF250000-memory.dmp
memory/3636-123-0x000001ADCF180000-0x000001ADCF190000-memory.dmp
memory/3636-126-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-128-0x000001ADCF190000-0x000001ADCF1A0000-memory.dmp
memory/3636-129-0x000001ADCF250000-0x000001ADCF260000-memory.dmp
memory/3636-132-0x000001ADCF1A0000-0x000001ADCF1B0000-memory.dmp
memory/3636-133-0x000001ADCF260000-0x000001ADCF270000-memory.dmp
memory/3636-136-0x000001ADCF270000-0x000001ADCF280000-memory.dmp
memory/3636-135-0x000001ADCF1B0000-0x000001ADCF1C0000-memory.dmp
memory/3636-138-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-140-0x000001ADCF1C0000-0x000001ADCF1D0000-memory.dmp
memory/3636-141-0x000001ADCF280000-0x000001ADCF290000-memory.dmp
memory/3636-143-0x000001ADCF1D0000-0x000001ADCF1E0000-memory.dmp
memory/3636-144-0x000001ADCF290000-0x000001ADCF2A0000-memory.dmp
memory/3636-147-0x000001ADCF1E0000-0x000001ADCF1F0000-memory.dmp
memory/3636-149-0x000001ADCF2A0000-0x000001ADCF2B0000-memory.dmp
memory/3636-148-0x000001ADCF1F0000-0x000001ADCF200000-memory.dmp
memory/3636-152-0x000001ADCF200000-0x000001ADCF210000-memory.dmp
memory/3636-153-0x000001ADCF210000-0x000001ADCF220000-memory.dmp
memory/3636-154-0x000001ADCF220000-0x000001ADCF230000-memory.dmp
memory/3636-155-0x000001ADCF2B0000-0x000001ADCF2C0000-memory.dmp
memory/3636-157-0x000001ADCF2C0000-0x000001ADCF2D0000-memory.dmp
memory/3636-158-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-160-0x000001ADCF230000-0x000001ADCF240000-memory.dmp
memory/3636-161-0x000001ADCF2D0000-0x000001ADCF2E0000-memory.dmp
memory/3636-163-0x000001ADCF240000-0x000001ADCF250000-memory.dmp
memory/3636-164-0x000001ADCF2E0000-0x000001ADCF2F0000-memory.dmp
memory/3636-166-0x000001ADCF250000-0x000001ADCF260000-memory.dmp
memory/3636-167-0x000001ADCF2F0000-0x000001ADCF300000-memory.dmp
memory/3636-170-0x000001ADCF260000-0x000001ADCF270000-memory.dmp
memory/3636-171-0x000001ADCF300000-0x000001ADCF310000-memory.dmp
memory/3636-174-0x000001ADCF310000-0x000001ADCF320000-memory.dmp
memory/3636-173-0x000001ADCF270000-0x000001ADCF280000-memory.dmp
memory/3636-177-0x000001ADCF280000-0x000001ADCF290000-memory.dmp
memory/3636-178-0x000001ADCF320000-0x000001ADCF330000-memory.dmp
memory/3636-180-0x000001ADCF290000-0x000001ADCF2A0000-memory.dmp
memory/3636-181-0x000001ADCF330000-0x000001ADCF340000-memory.dmp
memory/3636-185-0x000001ADCF340000-0x000001ADCF350000-memory.dmp
memory/3636-184-0x000001ADCF2A0000-0x000001ADCF2B0000-memory.dmp
memory/3636-186-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-187-0x000001ADCED90000-0x000001ADCED91000-memory.dmp
memory/3636-188-0x000001ADCF2B0000-0x000001ADCF2C0000-memory.dmp
memory/3636-189-0x000001ADCF2C0000-0x000001ADCF2D0000-memory.dmp
memory/3636-194-0x000001ADCED90000-0x000001ADCED91000-memory.dmp