Malware uses Java Archive (JAR)
Tags
| cmtmf-attack-pattern: | Code Injection |
| maec-delivery-vectors: | Watering Hole |
| attack-pattern: | Code Injection - T1540 Malware - T1587.001 Malware - T1588.001 Regsvr32 - T1218.010 Server - T1583.004 Server - T1584.004 Software - T1592.002 Regsvr32 - T1117 |
Common Information
| Type | Value |
|---|---|
| UUID | df758ce7-7d0c-4251-afbe-ee90bd6f6895 |
| Fingerprint | 27205850e1265713 |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Sept. 6, 2016, midnight |
| Added to db | Jan. 18, 2023, 11:54 p.m. |
| Last updated | Nov. 17, 2024, 6:54 p.m. |
| Headline | Malware uses Java Archive (JAR) |
| Title | Malware uses Java Archive (JAR) |
| Detected Hints/Tags/Attributes | 42/3/28 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | https://www.vmray.com/blog/malware-uses-java-archive-jar/ |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 1 | okokchave7.run |
|
| Details | Domain | 15 | www.vmray.com |
|
| Details | Domain | 622 | en.wikipedia.org |
|
| Details | Domain | 7 | www.java.com |
|
| Details | File | 1 | duplicata0.jar |
|
| Details | File | 1 | internal.jar |
|
| Details | File | 1 | injarloader.jar |
|
| Details | File | 1 | ljk32g1.txt |
|
| Details | File | 1 | ljk32g2.txt |
|
| Details | File | 1 | ljk32g4.txt |
|
| Details | File | 459 | regsvr32.exe |
|
| Details | File | 1 | ljk32g-2.dll |
|
| Details | File | 1 | ljk32g-4.dll |
|
| Details | File | 1260 | explorer.exe |
|
| Details | File | 1 | okokchave7.reg |
|
| Details | File | 10 | overview.html |
|
| Details | File | 14 | www.java |
|
| Details | sha256 | 1 | a2b467819bd03974f8b4ac326d9d488eb80680ee43cea984e160922122f1f048 |
|
| Details | Url | 1 | http://www.vmray.com/analyses/4199064/report/overview.html |
|
| Details | Url | 1 | https://en.wikipedia.org/wiki/java_applet |
|
| Details | Url | 1 | https://www.java.com/en/about |
|
| Details | Url | 1 | https://www.virustotal.com/de/file/a2b467819bd03974f8b4ac326d9d488eb80680ee43cea984e160922122f1f048/analysis |
|
| Details | Windows Registry Key | 47 | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
|
| Details | Windows Registry Key | 4 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA |
|
| Details | Windows Registry Key | 2 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin |
|
| Details | Windows Registry Key | 1 | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop |
|
| Details | Windows Registry Key | 11 | HKEY_CURRENT_USER\Software\Microsoft\Internet |
|
| Details | Windows Registry Key | 1 | HKLM\Software\Microsoft\Security |