Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/12/2024, 19:11
General
- Target c-users-vince-appdata-roaming-microsoft-windows-start-menu-programs-startup-jre-8u231-windows-x64-jar.jar
- Size 23.4MB
- Sample241216-xvxmmsxrfv
- SHA256 bb59ec29778a45324d437c67a0d18165b59823a01e78261a1c41c6a8069993fd
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 4 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\c-users-vince-appdata-roaming-microsoft-windows-start-menu-programs-startup-jre-8u231-windows-x64-jar.jar1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\c-users-vince-appdata-roaming-microsoft-windows-start-menu-programs-startup-jre-8u231-windows-x64-jar.jar" DELAY:32⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show networks mode=bssid3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
6FB285C6BE.sql
JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll
jna8711614280082242429.dll
sqlite-3.36.0.3-2ec81444-988d-4448-88ef-9c3342c7eeb6-sqlitejdbc.dll
83aa4cc77f591dfc2374580bbd95f6ba_5ab270f5-f3a9-47d1-97d7-bbd50acf9955
memory/1072-25-0x000001A10B950000-0x000001A10B960000-memory.dmp
memory/1072-63-0x000001A10B930000-0x000001A10B940000-memory.dmp
memory/1072-31-0x000001A10B980000-0x000001A10B990000-memory.dmp
memory/1072-27-0x000001A10B960000-0x000001A10B970000-memory.dmp
memory/1072-71-0x000001A10B960000-0x000001A10B970000-memory.dmp
memory/1072-23-0x000001A10B940000-0x000001A10B950000-memory.dmp
memory/1072-21-0x000001A10B930000-0x000001A10B940000-memory.dmp
memory/1072-2-0x000001A10B6C0000-0x000001A10B930000-memory.dmp
memory/1072-11-0x000001A109EB0000-0x000001A109EB1000-memory.dmp
memory/1072-29-0x000001A10B970000-0x000001A10B980000-memory.dmp
memory/1072-76-0x000001A10B6C0000-0x000001A10B930000-memory.dmp
memory/1072-75-0x000001A10B980000-0x000001A10B990000-memory.dmp
memory/1072-74-0x000001A10B970000-0x000001A10B980000-memory.dmp
memory/1072-65-0x000001A10B940000-0x000001A10B950000-memory.dmp
memory/1072-60-0x000001A10B6C0000-0x000001A10B930000-memory.dmp
memory/1072-73-0x000001A109EB0000-0x000001A109EB1000-memory.dmp
memory/1072-68-0x000001A10B950000-0x000001A10B960000-memory.dmp
memory/2372-103-0x0000018ED8DE0000-0x0000018ED8DF0000-memory.dmp
memory/2372-120-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-69-0x0000018ED8D70000-0x0000018ED8D80000-memory.dmp
memory/2372-66-0x0000018ED8D60000-0x0000018ED8D70000-memory.dmp
memory/2372-61-0x0000018ED8D40000-0x0000018ED8D50000-memory.dmp
memory/2372-62-0x0000018ED8D50000-0x0000018ED8D60000-memory.dmp
memory/2372-79-0x0000018ED8D80000-0x0000018ED8D90000-memory.dmp
memory/2372-78-0x0000018ED8AB0000-0x0000018ED8D20000-memory.dmp
memory/2372-57-0x0000018ED8D30000-0x0000018ED8D40000-memory.dmp
memory/2372-88-0x0000018ED8D90000-0x0000018ED8DA0000-memory.dmp
memory/2372-87-0x0000018ED8D20000-0x0000018ED8D30000-memory.dmp
memory/2372-91-0x0000018ED8D30000-0x0000018ED8D40000-memory.dmp
memory/2372-92-0x0000018ED8DA0000-0x0000018ED8DB0000-memory.dmp
memory/2372-95-0x0000018ED8DB0000-0x0000018ED8DC0000-memory.dmp
memory/2372-94-0x0000018ED8D40000-0x0000018ED8D50000-memory.dmp
memory/2372-100-0x0000018ED8DD0000-0x0000018ED8DE0000-memory.dmp
memory/2372-99-0x0000018ED8D60000-0x0000018ED8D70000-memory.dmp
memory/2372-98-0x0000018ED8DC0000-0x0000018ED8DD0000-memory.dmp
memory/2372-97-0x0000018ED8D50000-0x0000018ED8D60000-memory.dmp
memory/2372-55-0x0000018ED8D20000-0x0000018ED8D30000-memory.dmp
memory/2372-102-0x0000018ED8D70000-0x0000018ED8D80000-memory.dmp
memory/2372-107-0x0000018ED8DF0000-0x0000018ED8E00000-memory.dmp
memory/2372-112-0x0000018ED8E00000-0x0000018ED8E10000-memory.dmp
memory/2372-115-0x0000018ED8E10000-0x0000018ED8E20000-memory.dmp
memory/2372-117-0x0000018ED8D80000-0x0000018ED8D90000-memory.dmp
memory/2372-116-0x0000018ED8E20000-0x0000018ED8E30000-memory.dmp
memory/2372-122-0x0000018ED8D90000-0x0000018ED8DA0000-memory.dmp
memory/2372-126-0x0000018ED8DA0000-0x0000018ED8DB0000-memory.dmp
memory/2372-125-0x0000018ED8E50000-0x0000018ED8E60000-memory.dmp
memory/2372-124-0x0000018ED8E40000-0x0000018ED8E50000-memory.dmp
memory/2372-123-0x0000018ED8E30000-0x0000018ED8E40000-memory.dmp
memory/2372-70-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-132-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-133-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-147-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-151-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-155-0x0000018ED8DB0000-0x0000018ED8DC0000-memory.dmp
memory/2372-156-0x0000018ED8DC0000-0x0000018ED8DD0000-memory.dmp
memory/2372-162-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-166-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-165-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-164-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-163-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-177-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-182-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-183-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-189-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-187-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-195-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-208-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-45-0x0000018ED7220000-0x0000018ED7221000-memory.dmp
memory/2372-35-0x0000018ED8AB0000-0x0000018ED8D20000-memory.dmp
memory/2372-264-0x0000018ED8DD0000-0x0000018ED8DE0000-memory.dmp
memory/2372-267-0x0000018ED8DE0000-0x0000018ED8DF0000-memory.dmp
memory/2372-270-0x0000018ED8DF0000-0x0000018ED8E00000-memory.dmp
memory/2372-273-0x0000018ED8E00000-0x0000018ED8E10000-memory.dmp
memory/2372-276-0x0000018ED8E10000-0x0000018ED8E20000-memory.dmp
memory/2372-277-0x0000018ED8E20000-0x0000018ED8E30000-memory.dmp
memory/2372-282-0x0000018ED8E30000-0x0000018ED8E40000-memory.dmp
memory/2372-283-0x0000018ED8E40000-0x0000018ED8E50000-memory.dmp
memory/2372-284-0x0000018ED8E50000-0x0000018ED8E60000-memory.dmp