Analysis

  • max time kernel
    127s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2023 07:05

General

  • Target

    Delivery Information GCBAC71854_PDF.jar

  • Size

    182KB

  • MD5

    8b6d2e8ee9fb29b4095d861acbfa96f7

  • SHA1

    11189463a1f8558e688366fd47f6febfce3eb49b

  • SHA256

    6d641ee8729ed4c218ef958b79eef3729ec6317b7da31a41803407f41b68337a

  • SHA512

    944503c36f2358be6c1cf0c27166a1d3898a79b31081df36d61e4ff2101aa3f21d405df6c4217a8266bc1287abe753bd5e08d080e4e42e164cfe1b278e91176b

  • SSDEEP

    3072:zJjFn28eIl0XnNS87YO/YGHcTpVxjNVhp+K0dMfYDIO6LS/wxfs3Fl3ypGk04ADe:zJklXN7YAYgIpVbVhAndMf4p6LNGFl3+

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Delivery Information GCBAC71854_PDF.jar"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    688460d94a92032519419e979da46583

    SHA1

    eae7cf78c71cc2b854cf990858780af7f9e53479

    SHA256

    4121e75e18a42503915d728dfc14b8b1cf61034c8d19382de6ac0d759af1f6e9

    SHA512

    f3bae1b4f2e9de96d10c8badf394151b89b37fe827430de778efdfa4a6a07bb8aba09e26bef33e64826b5b2cb0cd3d8a73de25558718b113cb09c7c1fb3df0e0

  • memory/4324-44-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-20-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-47-0x0000022F43E40000-0x0000022F43E50000-memory.dmp

    Filesize

    64KB

  • memory/4324-30-0x0000022F421A0000-0x0000022F421A1000-memory.dmp

    Filesize

    4KB

  • memory/4324-34-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-41-0x0000022F421A0000-0x0000022F421A1000-memory.dmp

    Filesize

    4KB

  • memory/4324-42-0x0000022F43DF0000-0x0000022F43E00000-memory.dmp

    Filesize

    64KB

  • memory/4324-43-0x0000022F43E00000-0x0000022F43E10000-memory.dmp

    Filesize

    64KB

  • memory/4324-48-0x0000022F43E50000-0x0000022F43E60000-memory.dmp

    Filesize

    64KB

  • memory/4324-2-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-57-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-12-0x0000022F421A0000-0x0000022F421A1000-memory.dmp

    Filesize

    4KB

  • memory/4324-45-0x0000022F43E70000-0x0000022F43E80000-memory.dmp

    Filesize

    64KB

  • memory/4324-49-0x0000022F43E60000-0x0000022F43E70000-memory.dmp

    Filesize

    64KB

  • memory/4324-50-0x0000022F43E80000-0x0000022F43E90000-memory.dmp

    Filesize

    64KB

  • memory/4324-51-0x0000022F43E90000-0x0000022F43EA0000-memory.dmp

    Filesize

    64KB

  • memory/4324-52-0x0000022F43EB0000-0x0000022F43EC0000-memory.dmp

    Filesize

    64KB

  • memory/4324-54-0x0000022F43B70000-0x0000022F44B70000-memory.dmp

    Filesize

    16.0MB

  • memory/4324-53-0x0000022F43EC0000-0x0000022F43ED0000-memory.dmp

    Filesize

    64KB

  • memory/4324-55-0x0000022F43ED0000-0x0000022F43EE0000-memory.dmp

    Filesize

    64KB

  • memory/4324-56-0x0000022F43EE0000-0x0000022F43EF0000-memory.dmp

    Filesize

    64KB

  • memory/4324-46-0x0000022F43E30000-0x0000022F43E40000-memory.dmp

    Filesize

    64KB