Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20240508-en - resource tags
- submitted
25/06/2024, 13:30
General
- Target lasttry.jar
- Size 2.3MB
- Sample240625-qr2nvsseqb
- SHA256 c6d6095e46e233a7ab65808080de87f97098ece649a73c590b291c913e7ebc59
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\lasttry.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719322241316.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719322241316.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719322241316.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
1719322241316.tmp
memory/2720-2-0x0000026152E90000-0x0000026153100000-memory.dmp
memory/2720-16-0x0000026153100000-0x0000026153110000-memory.dmp
memory/2720-20-0x0000026153120000-0x0000026153130000-memory.dmp
memory/2720-19-0x0000026153110000-0x0000026153120000-memory.dmp
memory/2720-22-0x0000026153130000-0x0000026153140000-memory.dmp
memory/2720-24-0x0000026153140000-0x0000026153150000-memory.dmp
memory/2720-27-0x0000026153150000-0x0000026153160000-memory.dmp
memory/2720-30-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-35-0x0000026153170000-0x0000026153180000-memory.dmp
memory/2720-34-0x0000026153160000-0x0000026153170000-memory.dmp
memory/2720-38-0x0000026153180000-0x0000026153190000-memory.dmp
memory/2720-41-0x0000026153190000-0x00000261531A0000-memory.dmp
memory/2720-43-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-44-0x00000261531A0000-0x00000261531B0000-memory.dmp
memory/2720-46-0x0000026152E90000-0x0000026153100000-memory.dmp
memory/2720-47-0x00000261531B0000-0x00000261531C0000-memory.dmp
memory/2720-50-0x0000026153100000-0x0000026153110000-memory.dmp
memory/2720-51-0x00000261531C0000-0x00000261531D0000-memory.dmp
memory/2720-53-0x0000026153110000-0x0000026153120000-memory.dmp
memory/2720-55-0x00000261531D0000-0x00000261531E0000-memory.dmp
memory/2720-54-0x0000026153120000-0x0000026153130000-memory.dmp
memory/2720-58-0x0000026153130000-0x0000026153140000-memory.dmp
memory/2720-59-0x00000261531E0000-0x00000261531F0000-memory.dmp
memory/2720-60-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-61-0x0000026153140000-0x0000026153150000-memory.dmp
memory/2720-63-0x0000026153150000-0x0000026153160000-memory.dmp
memory/2720-66-0x0000026153160000-0x0000026153170000-memory.dmp
memory/2720-68-0x00000261531F0000-0x0000026153200000-memory.dmp
memory/2720-67-0x0000026153170000-0x0000026153180000-memory.dmp
memory/2720-70-0x0000026153180000-0x0000026153190000-memory.dmp
memory/2720-71-0x0000026153200000-0x0000026153210000-memory.dmp
memory/2720-73-0x0000026153190000-0x00000261531A0000-memory.dmp
memory/2720-74-0x0000026153210000-0x0000026153220000-memory.dmp
memory/2720-75-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-76-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-77-0x00000261531A0000-0x00000261531B0000-memory.dmp
memory/2720-78-0x00000261531B0000-0x00000261531C0000-memory.dmp
memory/2720-79-0x00000261531C0000-0x00000261531D0000-memory.dmp
memory/2720-80-0x00000261531D0000-0x00000261531E0000-memory.dmp
memory/2720-81-0x00000261531E0000-0x00000261531F0000-memory.dmp
memory/2720-83-0x00000261531F0000-0x0000026153200000-memory.dmp
memory/2720-84-0x0000026153220000-0x0000026153230000-memory.dmp
memory/2720-85-0x0000026153200000-0x0000026153210000-memory.dmp
memory/2720-86-0x0000026153210000-0x0000026153220000-memory.dmp
memory/2720-87-0x0000026151650000-0x0000026151651000-memory.dmp
memory/2720-90-0x0000026153220000-0x0000026153230000-memory.dmp
memory/2720-91-0x0000026153230000-0x0000026153240000-memory.dmp
memory/2720-93-0x0000026153230000-0x0000026153240000-memory.dmp
memory/2720-95-0x0000026153240000-0x0000026153250000-memory.dmp
memory/2720-97-0x0000026153240000-0x0000026153250000-memory.dmp
memory/2720-102-0x0000026153250000-0x0000026153260000-memory.dmp
memory/2720-103-0x0000026153260000-0x0000026153270000-memory.dmp