Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/10/2024, 13:32
General
- Target 63330f4b6a7a0d85e685e1f194bc677b513a266e77cc1d5a19ce27390429a2a7.jar
- Size 1.9MB
- Sample241014-qsyzcssarq
- SHA256 63330f4b6a7a0d85e685e1f194bc677b513a266e77cc1d5a19ce27390429a2a7
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\63330f4b6a7a0d85e685e1f194bc677b513a266e77cc1d5a19ce27390429a2a7.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728912732657.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728912732657.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1728912732657.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1728912732657.tmp
memory/1828-40-0x000002D2B18A0000-0x000002D2B18A1000-memory.dmp
memory/1828-54-0x000002D2B3420000-0x000002D2B3430000-memory.dmp
memory/1828-17-0x000002D2B3390000-0x000002D2B33A0000-memory.dmp
memory/1828-21-0x000002D2B33C0000-0x000002D2B33D0000-memory.dmp
memory/1828-41-0x000002D2B3390000-0x000002D2B33A0000-memory.dmp
memory/1828-25-0x000002D2B33E0000-0x000002D2B33F0000-memory.dmp
memory/1828-26-0x000002D2B18A0000-0x000002D2B18A1000-memory.dmp
memory/1828-28-0x000002D2B33F0000-0x000002D2B3400000-memory.dmp
memory/1828-30-0x000002D2B3400000-0x000002D2B3410000-memory.dmp
memory/1828-19-0x000002D2B33B0000-0x000002D2B33C0000-memory.dmp
memory/1828-34-0x000002D2B3410000-0x000002D2B3420000-memory.dmp
memory/1828-39-0x000002D2B3420000-0x000002D2B3430000-memory.dmp
memory/1828-18-0x000002D2B33A0000-0x000002D2B33B0000-memory.dmp
memory/1828-38-0x000002D2B3120000-0x000002D2B3390000-memory.dmp
memory/1828-23-0x000002D2B33D0000-0x000002D2B33E0000-memory.dmp
memory/1828-43-0x000002D2B33B0000-0x000002D2B33C0000-memory.dmp
memory/1828-42-0x000002D2B33A0000-0x000002D2B33B0000-memory.dmp
memory/1828-48-0x000002D2B33C0000-0x000002D2B33D0000-memory.dmp
memory/1828-49-0x000002D2B33D0000-0x000002D2B33E0000-memory.dmp
memory/1828-50-0x000002D2B33E0000-0x000002D2B33F0000-memory.dmp
memory/1828-51-0x000002D2B33F0000-0x000002D2B3400000-memory.dmp
memory/1828-52-0x000002D2B3400000-0x000002D2B3410000-memory.dmp
memory/1828-53-0x000002D2B3410000-0x000002D2B3420000-memory.dmp
memory/1828-2-0x000002D2B3120000-0x000002D2B3390000-memory.dmp
memory/1828-55-0x000002D2B3430000-0x000002D2B3440000-memory.dmp
memory/1828-56-0x000002D2B3430000-0x000002D2B3440000-memory.dmp
memory/1828-59-0x000002D2B3440000-0x000002D2B3450000-memory.dmp
memory/1828-60-0x000002D2B3440000-0x000002D2B3450000-memory.dmp