Analysis

  • max time kernel
    137s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2023 14:42

General

  • Target

    NEAS.27f16f3e0ae8499d98a9b7537ff2619d54bc8a7d8350f3f547521eb5b39bdb6bzip_JC.jar

  • Size

    164KB

  • MD5

    250d09e650c301b53d00a703f39354d1

  • SHA1

    aeb977370e8e40c7323ecebe262d153ea59bd7c6

  • SHA256

    27f16f3e0ae8499d98a9b7537ff2619d54bc8a7d8350f3f547521eb5b39bdb6b

  • SHA512

    26130963ba22be6a76bba8d9d6345bf2cd3098f1ba77aa623deed44dd8552268e37b27c50d0fa2727a98a95c2abcdc4fab82838c4e28b9d3cf9987e0b0c5c352

  • SSDEEP

    3072:Yw81M/EYAmf2Es926lSu9TFrkVYOms/0dOM4rgx+Feg0xwLxY5cE:YzIfNTu9TiVYOme0PQFAxw9KP

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\NEAS.27f16f3e0ae8499d98a9b7537ff2619d54bc8a7d8350f3f547521eb5b39bdb6bzip_JC.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    76700259541ed72c642cf7ac9a3d12a0

    SHA1

    be8de51b0f8a1cd7f742e21888ab93385759515a

    SHA256

    14fcc13381d75bce3a6180d37fff1b86de312a6c1a6a4a3362f732e16fde313d

    SHA512

    4af3dbfb0afb85c5c97b220f0a3155fe7decef773b815e414d2ebfee1ba05dbb26931b7911d3e3d0f3e2b69084f751adae98aaab4c7791b32266dd89f154c6e0

  • memory/2888-4-0x000001115A040000-0x000001115B040000-memory.dmp

    Filesize

    16.0MB

  • memory/2888-12-0x000001115A020000-0x000001115A021000-memory.dmp

    Filesize

    4KB

  • memory/2888-16-0x000001115A020000-0x000001115A021000-memory.dmp

    Filesize

    4KB