Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
02/12/2024, 08:31
General
- Target Tax-documents_PDF.jar
- Size 1.5MB
- Sample241202-ke7rfssrfq
- SHA256 634b6c0a26e822e2c6ba3d9f667c6d41abb76ea8b171b8376907e5151a95b227
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Tax-documents_PDF.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1733128325072.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1733128325072.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4368-2-0x0000016CAF150000-0x0000016CAF3C0000-memory.dmp
memory/4368-13-0x0000016CAF3C0000-0x0000016CAF3D0000-memory.dmp
memory/4368-14-0x0000016CAF3D0000-0x0000016CAF3E0000-memory.dmp
memory/4368-16-0x0000016CAF3E0000-0x0000016CAF3F0000-memory.dmp
memory/4368-18-0x0000016CAF3F0000-0x0000016CAF400000-memory.dmp
memory/4368-22-0x0000016CAF410000-0x0000016CAF420000-memory.dmp
memory/4368-21-0x0000016CAF400000-0x0000016CAF410000-memory.dmp
memory/4368-25-0x0000016CAF420000-0x0000016CAF430000-memory.dmp
memory/4368-26-0x0000016CAF430000-0x0000016CAF440000-memory.dmp
memory/4368-27-0x0000016CAF130000-0x0000016CAF131000-memory.dmp
memory/4368-33-0x0000016CAF150000-0x0000016CAF3C0000-memory.dmp
memory/4368-34-0x0000016CAF440000-0x0000016CAF450000-memory.dmp
memory/4368-35-0x0000016CAF130000-0x0000016CAF131000-memory.dmp
memory/4368-40-0x0000016CAF460000-0x0000016CAF470000-memory.dmp
memory/4368-38-0x0000016CAF450000-0x0000016CAF460000-memory.dmp
memory/4368-39-0x0000016CAF3C0000-0x0000016CAF3D0000-memory.dmp
memory/4368-43-0x0000016CAF470000-0x0000016CAF480000-memory.dmp
memory/4368-42-0x0000016CAF3D0000-0x0000016CAF3E0000-memory.dmp
memory/4368-47-0x0000016CAF480000-0x0000016CAF490000-memory.dmp
memory/4368-46-0x0000016CAF3E0000-0x0000016CAF3F0000-memory.dmp
memory/4368-49-0x0000016CAF490000-0x0000016CAF4A0000-memory.dmp
memory/4368-48-0x0000016CAF3F0000-0x0000016CAF400000-memory.dmp
memory/4368-51-0x0000016CAF400000-0x0000016CAF410000-memory.dmp
memory/4368-52-0x0000016CAF4A0000-0x0000016CAF4B0000-memory.dmp
memory/4368-56-0x0000016CAF4B0000-0x0000016CAF4C0000-memory.dmp
memory/4368-55-0x0000016CAF410000-0x0000016CAF420000-memory.dmp
memory/4368-59-0x0000016CAF4C0000-0x0000016CAF4D0000-memory.dmp
memory/4368-58-0x0000016CAF420000-0x0000016CAF430000-memory.dmp
memory/4368-62-0x0000016CAF130000-0x0000016CAF131000-memory.dmp
memory/4368-63-0x0000016CAF430000-0x0000016CAF440000-memory.dmp
memory/4368-64-0x0000016CAF440000-0x0000016CAF450000-memory.dmp
memory/4368-67-0x0000016CAF450000-0x0000016CAF460000-memory.dmp
memory/4368-70-0x0000016CAF460000-0x0000016CAF470000-memory.dmp
memory/4368-69-0x0000016CAF4E0000-0x0000016CAF4F0000-memory.dmp
memory/4368-68-0x0000016CAF4D0000-0x0000016CAF4E0000-memory.dmp
memory/4368-74-0x0000016CAF4F0000-0x0000016CAF500000-memory.dmp
memory/4368-73-0x0000016CAF470000-0x0000016CAF480000-memory.dmp
memory/4368-75-0x0000016CAF130000-0x0000016CAF131000-memory.dmp
memory/4368-77-0x0000016CAF480000-0x0000016CAF490000-memory.dmp
memory/4368-78-0x0000016CAF490000-0x0000016CAF4A0000-memory.dmp
memory/4368-79-0x0000016CAF4A0000-0x0000016CAF4B0000-memory.dmp
memory/4368-80-0x0000016CAF4B0000-0x0000016CAF4C0000-memory.dmp
memory/4368-83-0x0000016CAF4C0000-0x0000016CAF4D0000-memory.dmp
memory/4368-84-0x0000016CAF4D0000-0x0000016CAF4E0000-memory.dmp
memory/4368-85-0x0000016CAF4E0000-0x0000016CAF4F0000-memory.dmp
memory/4368-86-0x0000016CAF4F0000-0x0000016CAF500000-memory.dmp
memory/4368-87-0x0000016CAF500000-0x0000016CAF510000-memory.dmp
memory/4368-88-0x0000016CAF500000-0x0000016CAF510000-memory.dmp
memory/4368-91-0x0000016CAF510000-0x0000016CAF520000-memory.dmp
memory/4368-93-0x0000016CAF510000-0x0000016CAF520000-memory.dmp