Analysis
- max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/10/2024, 05:07
General
- Target 88ed9bf98dcee8fac802a3464ceac54ba2e5d0cc3367590ade74b66f643de4b8.jar
- Size 1.9MB
- Sample241016-fr9dlayapp
- SHA256 88ed9bf98dcee8fac802a3464ceac54ba2e5d0cc3367590ade74b66f643de4b8
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\88ed9bf98dcee8fac802a3464ceac54ba2e5d0cc3367590ade74b66f643de4b8.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729055258601.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729055258601.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729055258601.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1729055258601.tmp
memory/1396-40-0x0000017554890000-0x0000017554891000-memory.dmp
memory/1396-54-0x0000017556460000-0x0000017556470000-memory.dmp
memory/1396-20-0x00000175563E0000-0x00000175563F0000-memory.dmp
memory/1396-22-0x00000175563F0000-0x0000017556400000-memory.dmp
memory/1396-23-0x0000017556400000-0x0000017556410000-memory.dmp
memory/1396-27-0x0000017556420000-0x0000017556430000-memory.dmp
memory/1396-26-0x0000017556410000-0x0000017556420000-memory.dmp
memory/1396-29-0x0000017556430000-0x0000017556440000-memory.dmp
memory/1396-32-0x0000017556440000-0x0000017556450000-memory.dmp
memory/1396-31-0x0000017556150000-0x00000175563C0000-memory.dmp
memory/1396-33-0x0000017554890000-0x0000017554891000-memory.dmp
memory/1396-41-0x00000175563C0000-0x00000175563D0000-memory.dmp
memory/1396-16-0x00000175563C0000-0x00000175563D0000-memory.dmp
memory/1396-38-0x0000017556450000-0x0000017556460000-memory.dmp
memory/1396-17-0x00000175563D0000-0x00000175563E0000-memory.dmp
memory/1396-42-0x00000175563D0000-0x00000175563E0000-memory.dmp
memory/1396-44-0x00000175563E0000-0x00000175563F0000-memory.dmp
memory/1396-45-0x00000175563F0000-0x0000017556400000-memory.dmp
memory/1396-46-0x0000017556400000-0x0000017556410000-memory.dmp
memory/1396-47-0x0000017556410000-0x0000017556420000-memory.dmp
memory/1396-48-0x0000017556420000-0x0000017556430000-memory.dmp
memory/1396-49-0x0000017556430000-0x0000017556440000-memory.dmp
memory/1396-50-0x0000017556440000-0x0000017556450000-memory.dmp
memory/1396-51-0x0000017556450000-0x0000017556460000-memory.dmp
memory/1396-2-0x0000017556150000-0x00000175563C0000-memory.dmp
memory/1396-55-0x0000017554890000-0x0000017554891000-memory.dmp
memory/1396-56-0x0000017556460000-0x0000017556470000-memory.dmp