2d68b7c3e84a17714197334296201071e31487281dc119c7c1aecb32ec3ffda0

Analysis

max time kernel
147s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
25-06-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HELLO.jar
Size

2.3MB
MD5

3950c0d6bd731b2039ec1c7b33c76f52
SHA1

52452cc54408b66e300be5a1141fb7c2e8cc5246
SHA256

2d68b7c3e84a17714197334296201071e31487281dc119c7c1aecb32ec3ffda0
SHA512

1e6c68dc8d43c46abfc7fb5fd861d19a9ce6c80267eb072f0fece3001c3f654cb496413d73d48c5f6da8c20fd557e0873d5b1cdc731bb609bba5c20f06ed66a2
SSDEEP

49152:fGQma9w588m2GuzpK4JeT3gOtPWD0d0+aKWnGPLsFHRFZX:fXmb88QcpK4JeHJ8/nGPmHRz

Score

7^/10

discovery persistence

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1348 icacls.exe

pid	process
1348	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Microsoft\Windows\CurrentVersion\Run\Home = "C:\\Program Files\\Java\\jre-1.8\\bin\\javaw.exe -jar C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\.tmp\\1719321494323.tmp"	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

java.exe

pid process

4728 java.exe
4728 java.exe
4728 java.exe
4728 java.exe

pid	process
4728	java.exe
4728	java.exe
4728	java.exe
4728	java.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

java.execmd.exe

description	pid	process	target process
PID 4728 wrote to memory of 1348	4728	java.exe	icacls.exe
PID 4728 wrote to memory of 1348	4728	java.exe	icacls.exe
PID 4728 wrote to memory of 1584	4728	java.exe	attrib.exe
PID 4728 wrote to memory of 1584	4728	java.exe	attrib.exe
PID 4728 wrote to memory of 1500	4728	java.exe	cmd.exe
PID 4728 wrote to memory of 1500	4728	java.exe	cmd.exe
PID 1500 wrote to memory of 916	1500	cmd.exe	reg.exe
PID 1500 wrote to memory of 916	1500	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

1584 attrib.exe

pid	process
1584	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\HELLO.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1348

C:\Windows\SYSTEM32\attrib.exe
attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321494323.tmp
2⤵
- Views/modifies file attributes
PID:1584

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321494323.tmp" /f"
2⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\reg.exe
REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321494323.tmp" /f
3⤵
- Adds Run key to start application
PID:916

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
bdc60d7867a4ebd06e12844876fb0d8d

SHA1
0f551cc12da79457820b0eacec1157b838e51ac2

SHA256
c04e6b29243d521b351207ebfdee446f60e8517f7e34516ae0fa6962508a3af2

SHA512
bdcdb4ea827394e2e0d1d8fe838db0ef06d15722b3ecd2d097dee23e1ba0801284b64a2fd774cf3649d2ba1e3f7487f344ff9cfb2ee33cfe4d320f4b4390b76d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1719321494323.tmp
Filesize
2.3MB

MD5
3950c0d6bd731b2039ec1c7b33c76f52

SHA1
52452cc54408b66e300be5a1141fb7c2e8cc5246

SHA256
2d68b7c3e84a17714197334296201071e31487281dc119c7c1aecb32ec3ffda0

SHA512
1e6c68dc8d43c46abfc7fb5fd861d19a9ce6c80267eb072f0fece3001c3f654cb496413d73d48c5f6da8c20fd557e0873d5b1cdc731bb609bba5c20f06ed66a2

Download Submit
memory/4728-2-0x0000020600000000-0x0000020600270000-memory.dmp

Filesize
2.4MB

Download
memory/4728-18-0x0000020600280000-0x0000020600290000-memory.dmp

Filesize
64KB

Download
memory/4728-17-0x0000020600270000-0x0000020600280000-memory.dmp

Filesize
64KB

Download
memory/4728-22-0x00000206002A0000-0x00000206002B0000-memory.dmp

Filesize
64KB

Download
memory/4728-21-0x0000020600290000-0x00000206002A0000-memory.dmp

Filesize
64KB

Download
memory/4728-26-0x00000206002C0000-0x00000206002D0000-memory.dmp

Filesize
64KB

Download
memory/4728-25-0x00000206002B0000-0x00000206002C0000-memory.dmp

Filesize
64KB

Download
memory/4728-29-0x00000206002D0000-0x00000206002E0000-memory.dmp

Filesize
64KB

Download
memory/4728-31-0x00000206002E0000-0x00000206002F0000-memory.dmp

Filesize
64KB

Download
memory/4728-36-0x00000206002F0000-0x0000020600300000-memory.dmp

Filesize
64KB

Download
memory/4728-39-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-41-0x0000020600300000-0x0000020600310000-memory.dmp

Filesize
64KB

Download
memory/4728-43-0x0000020600310000-0x0000020600320000-memory.dmp

Filesize
64KB

Download
memory/4728-45-0x0000020600320000-0x0000020600330000-memory.dmp

Filesize
64KB

Download
memory/4728-48-0x0000020600000000-0x0000020600270000-memory.dmp

Filesize
2.4MB

Download
memory/4728-49-0x0000020600330000-0x0000020600340000-memory.dmp

Filesize
64KB

Download
memory/4728-51-0x0000020600270000-0x0000020600280000-memory.dmp

Filesize
64KB

Download
memory/4728-52-0x0000020600280000-0x0000020600290000-memory.dmp

Filesize
64KB

Download
memory/4728-53-0x0000020600340000-0x0000020600350000-memory.dmp

Filesize
64KB

Download
memory/4728-57-0x0000020600290000-0x00000206002A0000-memory.dmp

Filesize
64KB

Download
memory/4728-59-0x0000020600350000-0x0000020600360000-memory.dmp

Filesize
64KB

Download
memory/4728-58-0x00000206002A0000-0x00000206002B0000-memory.dmp

Filesize
64KB

Download
memory/4728-62-0x00000206002C0000-0x00000206002D0000-memory.dmp

Filesize
64KB

Download
memory/4728-61-0x00000206002B0000-0x00000206002C0000-memory.dmp

Filesize
64KB

Download
memory/4728-63-0x0000020600360000-0x0000020600370000-memory.dmp

Filesize
64KB

Download
memory/4728-64-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-66-0x00000206002D0000-0x00000206002E0000-memory.dmp

Filesize
64KB

Download
memory/4728-67-0x0000020600370000-0x0000020600380000-memory.dmp

Filesize
64KB

Download
memory/4728-69-0x00000206002E0000-0x00000206002F0000-memory.dmp

Filesize
64KB

Download
memory/4728-70-0x0000020600380000-0x0000020600390000-memory.dmp

Filesize
64KB

Download
memory/4728-75-0x0000020600390000-0x00000206003A0000-memory.dmp

Filesize
64KB

Download
memory/4728-74-0x00000206002F0000-0x0000020600300000-memory.dmp

Filesize
64KB

Download
memory/4728-77-0x0000020600300000-0x0000020600310000-memory.dmp

Filesize
64KB

Download
memory/4728-78-0x00000206003A0000-0x00000206003B0000-memory.dmp

Filesize
64KB

Download
memory/4728-80-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-82-0x00000206003B0000-0x00000206003C0000-memory.dmp

Filesize
64KB

Download
memory/4728-81-0x0000020600310000-0x0000020600320000-memory.dmp

Filesize
64KB

Download
memory/4728-83-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-86-0x00000206003C0000-0x00000206003D0000-memory.dmp

Filesize
64KB

Download
memory/4728-85-0x0000020600320000-0x0000020600330000-memory.dmp

Filesize
64KB

Download
memory/4728-88-0x0000020600330000-0x0000020600340000-memory.dmp

Filesize
64KB

Download
memory/4728-89-0x00000206003D0000-0x00000206003E0000-memory.dmp

Filesize
64KB

Download
memory/4728-92-0x0000020600340000-0x0000020600350000-memory.dmp

Filesize
64KB

Download
memory/4728-93-0x00000206003E0000-0x00000206003F0000-memory.dmp

Filesize
64KB

Download
memory/4728-96-0x0000020600350000-0x0000020600360000-memory.dmp

Filesize
64KB

Download
memory/4728-97-0x00000206003F0000-0x0000020600400000-memory.dmp

Filesize
64KB

Download
memory/4728-99-0x0000020600360000-0x0000020600370000-memory.dmp

Filesize
64KB

Download
memory/4728-100-0x0000020600400000-0x0000020600410000-memory.dmp

Filesize
64KB

Download
memory/4728-102-0x0000020600370000-0x0000020600380000-memory.dmp

Filesize
64KB

Download
memory/4728-103-0x0000020600410000-0x0000020600420000-memory.dmp

Filesize
64KB

Download
memory/4728-106-0x0000020600380000-0x0000020600390000-memory.dmp

Filesize
64KB

Download
memory/4728-107-0x0000020600420000-0x0000020600430000-memory.dmp

Filesize
64KB

Download
memory/4728-109-0x0000020600390000-0x00000206003A0000-memory.dmp

Filesize
64KB

Download
memory/4728-110-0x0000020600430000-0x0000020600440000-memory.dmp

Filesize
64KB

Download
memory/4728-111-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-112-0x00000206003A0000-0x00000206003B0000-memory.dmp

Filesize
64KB

Download
memory/4728-113-0x00000206003B0000-0x00000206003C0000-memory.dmp

Filesize
64KB

Download
memory/4728-114-0x00000206003C0000-0x00000206003D0000-memory.dmp

Filesize
64KB

Download
memory/4728-115-0x00000206003D0000-0x00000206003E0000-memory.dmp

Filesize
64KB

Download
memory/4728-116-0x00000206003E0000-0x00000206003F0000-memory.dmp

Filesize
64KB

Download
memory/4728-117-0x00000206003F0000-0x0000020600400000-memory.dmp

Filesize
64KB

Download
memory/4728-118-0x0000020600400000-0x0000020600410000-memory.dmp

Filesize
64KB

Download
memory/4728-119-0x0000020600410000-0x0000020600420000-memory.dmp

Filesize
64KB

Download
memory/4728-120-0x0000020600420000-0x0000020600430000-memory.dmp

Filesize
64KB

Download
memory/4728-121-0x0000020600430000-0x0000020600440000-memory.dmp

Filesize
64KB

Download
memory/4728-123-0x0000020600440000-0x0000020600450000-memory.dmp

Filesize
64KB

Download
memory/4728-124-0x0000020674DA0000-0x0000020674DA1000-memory.dmp

Filesize
4KB

Download
memory/4728-125-0x0000020600440000-0x0000020600450000-memory.dmp

Filesize
64KB

Download
memory/4728-128-0x0000020600450000-0x0000020600460000-memory.dmp

Filesize
64KB

Download
memory/4728-129-0x0000020600450000-0x0000020600460000-memory.dmp

Filesize
64KB

Download