Analysis
- max time kernel
144s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
13/08/2024, 10:28
General
- Target not a virus.jar
- Size 639KB
- Sample240813-mhpfdsyblb
- SHA256 6a5371e3e6dc931b4de6defc20d32179d42f9b6b3cb5ab3a5a99aef580385e96
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\not a virus.jar"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1723544904914.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1723544904914.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1723544904914.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1723544904914.tmp
memory/3328-2-0x0000025C4B760000-0x0000025C4B9D0000-memory.dmp
memory/3328-17-0x0000025C4B9E0000-0x0000025C4B9F0000-memory.dmp
memory/3328-16-0x0000025C4B9D0000-0x0000025C4B9E0000-memory.dmp
memory/3328-19-0x0000025C4B9F0000-0x0000025C4BA00000-memory.dmp
memory/3328-22-0x0000025C4BA00000-0x0000025C4BA10000-memory.dmp
memory/3328-23-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-24-0x0000025C4BA10000-0x0000025C4BA20000-memory.dmp
memory/3328-27-0x0000025C4BA20000-0x0000025C4BA30000-memory.dmp
memory/3328-28-0x0000025C4BA30000-0x0000025C4BA40000-memory.dmp
memory/3328-30-0x0000025C4BA40000-0x0000025C4BA50000-memory.dmp
memory/3328-33-0x0000025C4BA50000-0x0000025C4BA60000-memory.dmp
memory/3328-38-0x0000025C4BA60000-0x0000025C4BA70000-memory.dmp
memory/3328-42-0x0000025C4BA70000-0x0000025C4BA80000-memory.dmp
memory/3328-41-0x0000025C4B760000-0x0000025C4B9D0000-memory.dmp
memory/3328-47-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-46-0x0000025C4BA80000-0x0000025C4BA90000-memory.dmp
memory/3328-45-0x0000025C4B9E0000-0x0000025C4B9F0000-memory.dmp
memory/3328-44-0x0000025C4B9D0000-0x0000025C4B9E0000-memory.dmp
memory/3328-52-0x0000025C4BA90000-0x0000025C4BAA0000-memory.dmp
memory/3328-51-0x0000025C4B9F0000-0x0000025C4BA00000-memory.dmp
memory/3328-56-0x0000025C4BAA0000-0x0000025C4BAB0000-memory.dmp
memory/3328-55-0x0000025C4BA00000-0x0000025C4BA10000-memory.dmp
memory/3328-58-0x0000025C4BA10000-0x0000025C4BA20000-memory.dmp
memory/3328-59-0x0000025C4BAB0000-0x0000025C4BAC0000-memory.dmp
memory/3328-64-0x0000025C4BAC0000-0x0000025C4BAD0000-memory.dmp
memory/3328-63-0x0000025C4BA20000-0x0000025C4BA30000-memory.dmp
memory/3328-67-0x0000025C4BAD0000-0x0000025C4BAE0000-memory.dmp
memory/3328-66-0x0000025C4BA30000-0x0000025C4BA40000-memory.dmp
memory/3328-68-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-70-0x0000025C4BA40000-0x0000025C4BA50000-memory.dmp
memory/3328-71-0x0000025C4BAE0000-0x0000025C4BAF0000-memory.dmp
memory/3328-72-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-74-0x0000025C4BA50000-0x0000025C4BA60000-memory.dmp
memory/3328-77-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-78-0x0000025C4BA60000-0x0000025C4BA70000-memory.dmp
memory/3328-79-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-80-0x0000025C4BA70000-0x0000025C4BA80000-memory.dmp
memory/3328-81-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-87-0x0000025C4BAF0000-0x0000025C4BB00000-memory.dmp
memory/3328-86-0x0000025C4BA80000-0x0000025C4BA90000-memory.dmp
memory/3328-88-0x0000025C49DD0000-0x0000025C49DD1000-memory.dmp
memory/3328-89-0x0000025C4BA90000-0x0000025C4BAA0000-memory.dmp
memory/3328-90-0x0000025C4BAA0000-0x0000025C4BAB0000-memory.dmp
memory/3328-91-0x0000025C4BAB0000-0x0000025C4BAC0000-memory.dmp
memory/3328-92-0x0000025C4BAC0000-0x0000025C4BAD0000-memory.dmp
memory/3328-94-0x0000025C4BAD0000-0x0000025C4BAE0000-memory.dmp
memory/3328-95-0x0000025C4BAE0000-0x0000025C4BAF0000-memory.dmp
memory/3328-97-0x0000025C4BAF0000-0x0000025C4BB00000-memory.dmp
memory/3328-98-0x0000025C4BB00000-0x0000025C4BB10000-memory.dmp
memory/3328-99-0x0000025C4BB00000-0x0000025C4BB10000-memory.dmp
memory/3328-101-0x0000025C4B760000-0x0000025C4B9D0000-memory.dmp
memory/3328-113-0x0000025C4BB00000-0x0000025C4BB10000-memory.dmp
memory/3328-112-0x0000025C4BAF0000-0x0000025C4BB00000-memory.dmp
memory/3328-111-0x0000025C4BAB0000-0x0000025C4BAC0000-memory.dmp
memory/3328-110-0x0000025C4BA90000-0x0000025C4BAA0000-memory.dmp
memory/3328-109-0x0000025C4BA70000-0x0000025C4BA80000-memory.dmp
memory/3328-108-0x0000025C4BA60000-0x0000025C4BA70000-memory.dmp
memory/3328-107-0x0000025C4BA50000-0x0000025C4BA60000-memory.dmp
memory/3328-106-0x0000025C4BA40000-0x0000025C4BA50000-memory.dmp
memory/3328-105-0x0000025C4BA10000-0x0000025C4BA20000-memory.dmp
memory/3328-104-0x0000025C4BA00000-0x0000025C4BA10000-memory.dmp
memory/3328-103-0x0000025C4B9F0000-0x0000025C4BA00000-memory.dmp
memory/3328-102-0x0000025C4B9E0000-0x0000025C4B9F0000-memory.dmp