Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/11/2024, 12:20
General
- Target MIS_FILE_9888123_RECEIVED_xsls.jar
- Size 190KB
- Sample241121-phyeeawqal
- SHA256 bbd5de9d533b350b86e4d9aa54b6545c6e890c4f263ad27433b2c995faf89493
Malware Config
Signatures
- Drops startup file 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\MIS_FILE_9888123_RECEIVED_xsls.jar1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\java.exe"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\MIS_FILE_9888123_RECEIVED_xsls.jar"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MIS_FILE_9888123_RECEIVED_xsls.jar
3903daac9bc4a3b7.timestamp
memory/2936-79-0x000001B59B7D0000-0x000001B59B7E0000-memory.dmp
memory/2936-74-0x000001B59B830000-0x000001B59B840000-memory.dmp
memory/2936-84-0x000001B59B820000-0x000001B59B830000-memory.dmp
memory/2936-83-0x000001B59B810000-0x000001B59B820000-memory.dmp
memory/2936-82-0x000001B59B800000-0x000001B59B810000-memory.dmp
memory/2936-81-0x000001B59B7F0000-0x000001B59B800000-memory.dmp
memory/2936-80-0x000001B59B7E0000-0x000001B59B7F0000-memory.dmp
memory/2936-86-0x000001B59B840000-0x000001B59B850000-memory.dmp
memory/2936-59-0x000001B59B7D0000-0x000001B59B7E0000-memory.dmp
memory/2936-77-0x000001B59B7C0000-0x000001B59B7D0000-memory.dmp
memory/2936-76-0x000001B59B550000-0x000001B59B7C0000-memory.dmp
memory/2936-85-0x000001B59B830000-0x000001B59B840000-memory.dmp
memory/2936-71-0x000001B599CA0000-0x000001B599CA1000-memory.dmp
memory/2936-70-0x000001B59B820000-0x000001B59B830000-memory.dmp
memory/2936-46-0x000001B59B550000-0x000001B59B7C0000-memory.dmp
memory/2936-68-0x000001B59B810000-0x000001B59B820000-memory.dmp
memory/2936-65-0x000001B59B800000-0x000001B59B810000-memory.dmp
memory/2936-63-0x000001B59B7F0000-0x000001B59B800000-memory.dmp
memory/2936-62-0x000001B59B7E0000-0x000001B59B7F0000-memory.dmp
memory/2936-87-0x000001B59B850000-0x000001B59B860000-memory.dmp
memory/2936-57-0x000001B59B7C0000-0x000001B59B7D0000-memory.dmp
memory/4720-32-0x0000018492DE0000-0x0000018492DE1000-memory.dmp
memory/4720-34-0x0000018494650000-0x00000184948C0000-memory.dmp
memory/4720-35-0x00000184948C0000-0x00000184948D0000-memory.dmp
memory/4720-36-0x00000184948D0000-0x00000184948E0000-memory.dmp
memory/4720-37-0x00000184948E0000-0x00000184948F0000-memory.dmp
memory/4720-38-0x00000184948F0000-0x0000018494900000-memory.dmp
memory/4720-39-0x0000018494900000-0x0000018494910000-memory.dmp
memory/4720-42-0x0000018494930000-0x0000018494940000-memory.dmp
memory/4720-41-0x0000018494920000-0x0000018494930000-memory.dmp
memory/4720-40-0x0000018494910000-0x0000018494920000-memory.dmp
memory/4720-2-0x0000018494650000-0x00000184948C0000-memory.dmp
memory/4720-26-0x0000018494930000-0x0000018494940000-memory.dmp
memory/4720-24-0x0000018494920000-0x0000018494930000-memory.dmp
memory/4720-22-0x0000018494910000-0x0000018494920000-memory.dmp
memory/4720-21-0x0000018494900000-0x0000018494910000-memory.dmp
memory/4720-18-0x00000184948F0000-0x0000018494900000-memory.dmp
memory/4720-16-0x00000184948E0000-0x00000184948F0000-memory.dmp
memory/4720-14-0x00000184948D0000-0x00000184948E0000-memory.dmp
memory/4720-12-0x00000184948C0000-0x00000184948D0000-memory.dmp