Resubmissions
18/09/2024, 11:17
240918-ndn5haxejf1018/09/2024, 11:06
240918-m7jlfaxbpe1018/09/2024, 10:55
240918-m1jymawhkb10Analysis
- max time kernel
472s - max time network
439s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/09/2024, 11:17
General
- Target piska.jar
- Size 11.7MB
- Sample240918-ndn5haxejf
- SHA256 035df58f5ccdcb81c884cc75ae240d2b3154036891943e320d85fd7e0bd9812f
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\piska.jar1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1726658246218.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1726658246218.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1726658246218.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
imageio1171344262910138145.tmp
imageio1617215351652268550.tmp
imageio2039804817096980519.tmp
imageio3726755643415199328.tmp
imageio4902338556124506765.tmp
imageio5272474549243379409.tmp
imageio6274722892436393700.tmp
imageio6714215683320832765.tmp
imageio6719147125241537397.tmp
imageio6741919825435978227.tmp
imageio6760476641116768146.tmp
imageio7108125553341939154.tmp
imageio7361007416340812187.tmp
imageio7932045124594969923.tmp
imageio8516220643935969545.tmp
imageio8711617804558439855.tmp
imageio8717529849160611266.tmp
imageio8786132248605882803.tmp
imageio8886821877124534099.tmp
imageio9118926473792577365.tmp
1726658246218.tmp
ima123ge.png
memory/224-144-0x0000028669B50000-0x0000028669B60000-memory.dmp
memory/224-292-0x0000028669BC0000-0x0000028669BD0000-memory.dmp
memory/224-50-0x00000286699E0000-0x00000286699F0000-memory.dmp
memory/224-51-0x00000286699F0000-0x0000028669A00000-memory.dmp
memory/224-52-0x0000028669A00000-0x0000028669A10000-memory.dmp
memory/224-53-0x0000028669A10000-0x0000028669A20000-memory.dmp
memory/224-54-0x0000028669A20000-0x0000028669A30000-memory.dmp
memory/224-55-0x0000028669A30000-0x0000028669A40000-memory.dmp
memory/224-56-0x0000028669A40000-0x0000028669A50000-memory.dmp
memory/224-58-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-59-0x0000028669A50000-0x0000028669A60000-memory.dmp
memory/224-62-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-63-0x0000028669A60000-0x0000028669A70000-memory.dmp
memory/224-66-0x0000028669A70000-0x0000028669A80000-memory.dmp
memory/224-68-0x0000028669A60000-0x0000028669A70000-memory.dmp
memory/224-69-0x0000028669A70000-0x0000028669A80000-memory.dmp
memory/224-73-0x0000028669A80000-0x0000028669A90000-memory.dmp
memory/224-74-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-79-0x0000028669A90000-0x0000028669AA0000-memory.dmp
memory/224-85-0x0000028669AA0000-0x0000028669AB0000-memory.dmp
memory/224-90-0x0000028669AB0000-0x0000028669AC0000-memory.dmp
memory/224-91-0x0000028669A80000-0x0000028669A90000-memory.dmp
memory/224-95-0x0000028669AC0000-0x0000028669AD0000-memory.dmp
memory/224-94-0x0000028669A90000-0x0000028669AA0000-memory.dmp
memory/224-98-0x0000028669AE0000-0x0000028669AF0000-memory.dmp
memory/224-101-0x0000028669AF0000-0x0000028669B00000-memory.dmp
memory/224-104-0x0000028669B00000-0x0000028669B10000-memory.dmp
memory/224-106-0x0000028669AA0000-0x0000028669AB0000-memory.dmp
memory/224-112-0x0000028669B10000-0x0000028669B20000-memory.dmp
memory/224-114-0x0000028669AB0000-0x0000028669AC0000-memory.dmp
memory/224-116-0x0000028669B30000-0x0000028669B40000-memory.dmp
memory/224-118-0x0000028669AC0000-0x0000028669AD0000-memory.dmp
memory/224-120-0x0000028669AE0000-0x0000028669AF0000-memory.dmp
memory/224-122-0x0000028669AF0000-0x0000028669B00000-memory.dmp
memory/224-123-0x0000028669B00000-0x0000028669B10000-memory.dmp
memory/224-124-0x0000028669B10000-0x0000028669B20000-memory.dmp
memory/224-125-0x0000028669B30000-0x0000028669B40000-memory.dmp
memory/224-135-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-138-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-141-0x0000028669B40000-0x0000028669B50000-memory.dmp
memory/224-140-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-143-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-47-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-146-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-147-0x0000028669B40000-0x0000028669B50000-memory.dmp
memory/224-152-0x0000028669B60000-0x0000028669B70000-memory.dmp
memory/224-156-0x0000028669B50000-0x0000028669B60000-memory.dmp
memory/224-166-0x0000028669B60000-0x0000028669B70000-memory.dmp
memory/224-181-0x0000028669B70000-0x0000028669B80000-memory.dmp
memory/224-212-0x0000028669B80000-0x0000028669B90000-memory.dmp
memory/224-226-0x0000028669B90000-0x0000028669BA0000-memory.dmp
memory/224-240-0x0000028669BA0000-0x0000028669BB0000-memory.dmp
memory/224-269-0x0000028669BB0000-0x0000028669BC0000-memory.dmp
memory/224-48-0x00000286699D0000-0x00000286699E0000-memory.dmp
memory/224-315-0x0000028669BD0000-0x0000028669BE0000-memory.dmp
memory/224-328-0x0000028669B70000-0x0000028669B80000-memory.dmp
memory/224-381-0x0000028669B80000-0x0000028669B90000-memory.dmp
memory/224-382-0x0000028669BE0000-0x0000028669BF0000-memory.dmp
memory/224-441-0x0000028669BF0000-0x0000028669C00000-memory.dmp
memory/224-440-0x0000028669B90000-0x0000028669BA0000-memory.dmp
memory/224-443-0x0000028669BA0000-0x0000028669BB0000-memory.dmp
memory/224-444-0x0000028669BB0000-0x0000028669BC0000-memory.dmp
memory/224-445-0x0000028669BC0000-0x0000028669BD0000-memory.dmp
memory/224-446-0x0000028669BD0000-0x0000028669BE0000-memory.dmp
memory/224-447-0x0000028669BE0000-0x0000028669BF0000-memory.dmp
memory/224-450-0x0000028669BF0000-0x0000028669C00000-memory.dmp
memory/224-524-0x0000028669C00000-0x0000028669C10000-memory.dmp
memory/224-581-0x0000028669C00000-0x0000028669C10000-memory.dmp
memory/224-46-0x0000028669A50000-0x0000028669A60000-memory.dmp
memory/224-43-0x00000286699B0000-0x00000286699C0000-memory.dmp
memory/224-770-0x0000028669C20000-0x0000028669C30000-memory.dmp
memory/224-772-0x0000028669C10000-0x0000028669C20000-memory.dmp
memory/224-778-0x0000028669C30000-0x0000028669C40000-memory.dmp
memory/224-787-0x0000028669C40000-0x0000028669C50000-memory.dmp
memory/224-797-0x0000028669C20000-0x0000028669C30000-memory.dmp
memory/224-801-0x0000028669C10000-0x0000028669C20000-memory.dmp
memory/224-812-0x0000028669C30000-0x0000028669C40000-memory.dmp
memory/224-826-0x0000028669C40000-0x0000028669C50000-memory.dmp
memory/224-868-0x0000028669C60000-0x0000028669C70000-memory.dmp
memory/224-892-0x0000028669C70000-0x0000028669C80000-memory.dmp
memory/224-44-0x00000286699C0000-0x00000286699D0000-memory.dmp
memory/224-924-0x0000028669C60000-0x0000028669C70000-memory.dmp
memory/224-936-0x0000028669C80000-0x0000028669C90000-memory.dmp
memory/224-958-0x0000028669C90000-0x0000028669CA0000-memory.dmp
memory/224-42-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-39-0x0000028669A40000-0x0000028669A50000-memory.dmp
memory/224-37-0x0000028669740000-0x00000286699B0000-memory.dmp
memory/224-34-0x0000028667F70000-0x0000028667F71000-memory.dmp
memory/224-31-0x0000028669A30000-0x0000028669A40000-memory.dmp
memory/224-29-0x0000028669A20000-0x0000028669A30000-memory.dmp
memory/224-26-0x0000028669A00000-0x0000028669A10000-memory.dmp
memory/224-27-0x0000028669A10000-0x0000028669A20000-memory.dmp
memory/224-23-0x00000286699F0000-0x0000028669A00000-memory.dmp
memory/224-22-0x00000286699E0000-0x00000286699F0000-memory.dmp
memory/224-19-0x00000286699D0000-0x00000286699E0000-memory.dmp
memory/224-16-0x00000286699B0000-0x00000286699C0000-memory.dmp
memory/224-1072-0x0000028669CA0000-0x0000028669CB0000-memory.dmp
memory/224-17-0x00000286699C0000-0x00000286699D0000-memory.dmp
memory/224-1102-0x0000028669CB0000-0x0000028669CC0000-memory.dmp
memory/224-1182-0x0000028669CC0000-0x0000028669CD0000-memory.dmp
memory/224-1198-0x0000028669C80000-0x0000028669C90000-memory.dmp
memory/224-1203-0x0000028669C90000-0x0000028669CA0000-memory.dmp
memory/224-1206-0x0000028669CD0000-0x0000028669CE0000-memory.dmp
memory/224-1234-0x0000028669CE0000-0x0000028669CF0000-memory.dmp
memory/224-1233-0x0000028669CA0000-0x0000028669CB0000-memory.dmp
memory/224-1236-0x0000028669CB0000-0x0000028669CC0000-memory.dmp
memory/224-2-0x0000028669740000-0x00000286699B0000-memory.dmp