Analysis
- max time kernel
94s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
01/08/2024, 12:41
Errors
General
- Target 12345634623.jar
- Size 639KB
- Sample240801-pwxp2a1dln
- SHA256 c319fc9345449fe0344518aa0ce95857c84206abcc044150a288543df3485d15
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\12345634623.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722516101516.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722516101516.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1722516101516.tmp" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\SYSTEM32\reg.exereg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v Home2⤵
-
-
C:\Windows\SYSTEM32\shutdown.exeshutdown /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3942855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1722516101516.tmp
memory/1416-2-0x000001C5924A0000-0x000001C592710000-memory.dmp
memory/1416-17-0x000001C592720000-0x000001C592730000-memory.dmp
memory/1416-19-0x000001C592730000-0x000001C592740000-memory.dmp
memory/1416-16-0x000001C592710000-0x000001C592720000-memory.dmp
memory/1416-21-0x000001C592740000-0x000001C592750000-memory.dmp
memory/1416-23-0x000001C592750000-0x000001C592760000-memory.dmp
memory/1416-25-0x000001C592760000-0x000001C592770000-memory.dmp
memory/1416-26-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-34-0x000001C592790000-0x000001C5927A0000-memory.dmp
memory/1416-31-0x000001C592780000-0x000001C592790000-memory.dmp
memory/1416-29-0x000001C592770000-0x000001C592780000-memory.dmp
memory/1416-39-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-44-0x000001C5927A0000-0x000001C5927B0000-memory.dmp
memory/1416-47-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-43-0x000001C5924A0000-0x000001C592710000-memory.dmp
memory/1416-49-0x000001C592720000-0x000001C592730000-memory.dmp
memory/1416-48-0x000001C592710000-0x000001C592720000-memory.dmp
memory/1416-51-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-54-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-55-0x000001C592730000-0x000001C592740000-memory.dmp
memory/1416-57-0x000001C592740000-0x000001C592750000-memory.dmp
memory/1416-58-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-62-0x000001C592750000-0x000001C592760000-memory.dmp
memory/1416-64-0x000001C592760000-0x000001C592770000-memory.dmp
memory/1416-66-0x000001C592770000-0x000001C592780000-memory.dmp
memory/1416-67-0x000001C592780000-0x000001C592790000-memory.dmp
memory/1416-68-0x000001C592790000-0x000001C5927A0000-memory.dmp
memory/1416-72-0x000001C5927B0000-0x000001C5927C0000-memory.dmp
memory/1416-71-0x000001C5927A0000-0x000001C5927B0000-memory.dmp
memory/1416-79-0x000001C5927C0000-0x000001C5927D0000-memory.dmp
memory/1416-78-0x000001C5927B0000-0x000001C5927C0000-memory.dmp
memory/1416-81-0x000001C5927D0000-0x000001C5927E0000-memory.dmp
memory/1416-85-0x000001C5927F0000-0x000001C592800000-memory.dmp
memory/1416-84-0x000001C5927E0000-0x000001C5927F0000-memory.dmp
memory/1416-91-0x000001C592820000-0x000001C592830000-memory.dmp
memory/1416-90-0x000001C592810000-0x000001C592820000-memory.dmp
memory/1416-89-0x000001C592800000-0x000001C592810000-memory.dmp
memory/1416-95-0x000001C592840000-0x000001C592850000-memory.dmp
memory/1416-94-0x000001C592830000-0x000001C592840000-memory.dmp
memory/1416-99-0x000001C592850000-0x000001C592860000-memory.dmp
memory/1416-100-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-104-0x000001C592860000-0x000001C592870000-memory.dmp
memory/1416-107-0x000001C592870000-0x000001C592880000-memory.dmp
memory/1416-108-0x000001C592880000-0x000001C592890000-memory.dmp
memory/1416-114-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-117-0x000001C5927C0000-0x000001C5927D0000-memory.dmp
memory/1416-118-0x000001C592890000-0x000001C5928A0000-memory.dmp
memory/1416-121-0x000001C5927D0000-0x000001C5927E0000-memory.dmp
memory/1416-122-0x000001C5928A0000-0x000001C5928B0000-memory.dmp
memory/1416-123-0x000001C5927E0000-0x000001C5927F0000-memory.dmp
memory/1416-124-0x000001C5927F0000-0x000001C592800000-memory.dmp
memory/1416-126-0x000001C5928B0000-0x000001C5928C0000-memory.dmp
memory/1416-125-0x000001C592800000-0x000001C592810000-memory.dmp
memory/1416-130-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-131-0x000001C592810000-0x000001C592820000-memory.dmp
memory/1416-134-0x000001C5928C0000-0x000001C5928D0000-memory.dmp
memory/1416-133-0x000001C592820000-0x000001C592830000-memory.dmp
memory/1416-135-0x000001C590C20000-0x000001C590C21000-memory.dmp
memory/1416-137-0x000001C592830000-0x000001C592840000-memory.dmp
memory/1416-139-0x000001C5928D0000-0x000001C5928E0000-memory.dmp
memory/1416-138-0x000001C592840000-0x000001C592850000-memory.dmp
memory/1416-146-0x000001C592850000-0x000001C592860000-memory.dmp
memory/1416-147-0x000001C5928E0000-0x000001C5928F0000-memory.dmp
memory/1416-152-0x000001C592860000-0x000001C592870000-memory.dmp
memory/1416-153-0x000001C5928F0000-0x000001C592900000-memory.dmp
memory/1416-157-0x000001C592870000-0x000001C592880000-memory.dmp
memory/1416-160-0x000001C592880000-0x000001C592890000-memory.dmp
memory/1416-161-0x000001C592900000-0x000001C592910000-memory.dmp
memory/1416-166-0x000001C592910000-0x000001C592920000-memory.dmp
memory/1416-165-0x000001C592890000-0x000001C5928A0000-memory.dmp
memory/1416-176-0x000001C5928A0000-0x000001C5928B0000-memory.dmp
memory/1416-177-0x000001C592930000-0x000001C592940000-memory.dmp
memory/1416-182-0x000001C5928B0000-0x000001C5928C0000-memory.dmp
memory/1416-192-0x000001C592940000-0x000001C592950000-memory.dmp
memory/1416-191-0x000001C5928C0000-0x000001C5928D0000-memory.dmp
memory/1416-199-0x000001C5928D0000-0x000001C5928E0000-memory.dmp
memory/1416-206-0x000001C5928E0000-0x000001C5928F0000-memory.dmp
memory/1416-212-0x000001C592960000-0x000001C592970000-memory.dmp
memory/1416-211-0x000001C5928F0000-0x000001C592900000-memory.dmp
memory/1416-215-0x000001C592970000-0x000001C592980000-memory.dmp
memory/1416-227-0x000001C592900000-0x000001C592910000-memory.dmp
memory/1416-236-0x000001C592910000-0x000001C592920000-memory.dmp
memory/1416-237-0x000001C592980000-0x000001C592990000-memory.dmp
memory/1416-253-0x000001C592930000-0x000001C592940000-memory.dmp
memory/1416-269-0x000001C592990000-0x000001C5929A0000-memory.dmp
memory/1416-287-0x000001C592940000-0x000001C592950000-memory.dmp
memory/1416-342-0x000001C592960000-0x000001C592970000-memory.dmp
memory/1416-367-0x000001C592720000-0x000001C592730000-memory.dmp
memory/1416-383-0x000001C592800000-0x000001C592810000-memory.dmp
memory/1416-382-0x000001C592810000-0x000001C592820000-memory.dmp
memory/1416-381-0x000001C592820000-0x000001C592830000-memory.dmp
memory/1416-380-0x000001C5927F0000-0x000001C592800000-memory.dmp
memory/1416-379-0x000001C5927E0000-0x000001C5927F0000-memory.dmp
memory/1416-378-0x000001C5927D0000-0x000001C5927E0000-memory.dmp
memory/1416-377-0x000001C5927C0000-0x000001C5927D0000-memory.dmp
memory/1416-376-0x000001C5927B0000-0x000001C5927C0000-memory.dmp
memory/1416-375-0x000001C5927A0000-0x000001C5927B0000-memory.dmp
memory/1416-374-0x000001C592790000-0x000001C5927A0000-memory.dmp
memory/1416-373-0x000001C592780000-0x000001C592790000-memory.dmp
memory/1416-372-0x000001C592770000-0x000001C592780000-memory.dmp
memory/1416-371-0x000001C592760000-0x000001C592770000-memory.dmp
memory/1416-370-0x000001C592750000-0x000001C592760000-memory.dmp
memory/1416-369-0x000001C592740000-0x000001C592750000-memory.dmp
memory/1416-368-0x000001C592730000-0x000001C592740000-memory.dmp
memory/1416-366-0x000001C592710000-0x000001C592720000-memory.dmp
memory/1416-365-0x000001C5924A0000-0x000001C592710000-memory.dmp