Analysis
- max time kernel
1788s - max time network
1800s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/09/2024, 01:13
General
- Target Keyboard sound changer.jar
- Size 9.1MB
- Sample240909-bla7dsxbme
- SHA256 6a7440deac3190ddf7c6c0de2818e851752349c3017659eaa8ce8d6637bd31b3
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Keyboard sound changer.jar"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1725844417835.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1725844417835.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1725844417835.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1725844417835.tmp
memory/3180-2-0x000001E217C50000-0x000001E217EC0000-memory.dmp
memory/3180-17-0x000001E217ED0000-0x000001E217EE0000-memory.dmp
memory/3180-18-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-16-0x000001E217EC0000-0x000001E217ED0000-memory.dmp
memory/3180-23-0x000001E217EF0000-0x000001E217F00000-memory.dmp
memory/3180-24-0x000001E217F00000-0x000001E217F10000-memory.dmp
memory/3180-26-0x000001E217F10000-0x000001E217F20000-memory.dmp
memory/3180-21-0x000001E217EE0000-0x000001E217EF0000-memory.dmp
memory/3180-28-0x000001E217F20000-0x000001E217F30000-memory.dmp
memory/3180-30-0x000001E217F30000-0x000001E217F40000-memory.dmp
memory/3180-34-0x000001E217F40000-0x000001E217F50000-memory.dmp
memory/3180-33-0x000001E217C50000-0x000001E217EC0000-memory.dmp
memory/3180-38-0x000001E217F50000-0x000001E217F60000-memory.dmp
memory/3180-44-0x000001E217F60000-0x000001E217F70000-memory.dmp
memory/3180-43-0x000001E217ED0000-0x000001E217EE0000-memory.dmp
memory/3180-42-0x000001E217EC0000-0x000001E217ED0000-memory.dmp
memory/3180-45-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-46-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-51-0x000001E217F70000-0x000001E217F80000-memory.dmp
memory/3180-50-0x000001E217EE0000-0x000001E217EF0000-memory.dmp
memory/3180-55-0x000001E217F80000-0x000001E217F90000-memory.dmp
memory/3180-54-0x000001E217EF0000-0x000001E217F00000-memory.dmp
memory/3180-58-0x000001E217F90000-0x000001E217FA0000-memory.dmp
memory/3180-62-0x000001E217F00000-0x000001E217F10000-memory.dmp
memory/3180-63-0x000001E217FA0000-0x000001E217FB0000-memory.dmp
memory/3180-66-0x000001E217FB0000-0x000001E217FC0000-memory.dmp
memory/3180-65-0x000001E217F10000-0x000001E217F20000-memory.dmp
memory/3180-67-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-68-0x000001E217F20000-0x000001E217F30000-memory.dmp
memory/3180-70-0x000001E217F30000-0x000001E217F40000-memory.dmp
memory/3180-71-0x000001E217F40000-0x000001E217F50000-memory.dmp
memory/3180-72-0x000001E217F50000-0x000001E217F60000-memory.dmp
memory/3180-73-0x000001E217F60000-0x000001E217F70000-memory.dmp
memory/3180-74-0x000001E217F70000-0x000001E217F80000-memory.dmp
memory/3180-75-0x000001E217F80000-0x000001E217F90000-memory.dmp
memory/3180-76-0x000001E217F90000-0x000001E217FA0000-memory.dmp
memory/3180-77-0x000001E217FA0000-0x000001E217FB0000-memory.dmp
memory/3180-78-0x000001E217FB0000-0x000001E217FC0000-memory.dmp
memory/3180-80-0x000001E217FC0000-0x000001E217FD0000-memory.dmp
memory/3180-81-0x000001E217FC0000-0x000001E217FD0000-memory.dmp
memory/3180-87-0x000001E217FD0000-0x000001E217FE0000-memory.dmp
memory/3180-90-0x000001E217FD0000-0x000001E217FE0000-memory.dmp
memory/3180-92-0x000001E217FF0000-0x000001E218000000-memory.dmp
memory/3180-93-0x000001E217FF0000-0x000001E218000000-memory.dmp
memory/3180-96-0x000001E218000000-0x000001E218010000-memory.dmp
memory/3180-98-0x000001E218000000-0x000001E218010000-memory.dmp
memory/3180-102-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-103-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-106-0x000001E218010000-0x000001E218020000-memory.dmp
memory/3180-108-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-111-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-113-0x000001E218020000-0x000001E218030000-memory.dmp
memory/3180-114-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-118-0x000001E218020000-0x000001E218030000-memory.dmp
memory/3180-124-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-126-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-129-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-130-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-132-0x000001E218030000-0x000001E218040000-memory.dmp
memory/3180-133-0x000001E218030000-0x000001E218040000-memory.dmp
memory/3180-135-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-138-0x000001E218040000-0x000001E218050000-memory.dmp
memory/3180-144-0x000001E218040000-0x000001E218050000-memory.dmp
memory/3180-152-0x000001E218050000-0x000001E218060000-memory.dmp
memory/3180-157-0x000001E218060000-0x000001E218070000-memory.dmp
memory/3180-159-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-165-0x000001E218070000-0x000001E218080000-memory.dmp
memory/3180-168-0x000001E218070000-0x000001E218080000-memory.dmp
memory/3180-172-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-173-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-191-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-192-0x000001E217C30000-0x000001E217C31000-memory.dmp
memory/3180-193-0x000001E217C30000-0x000001E217C31000-memory.dmp