Overview
overview
7Static
static
1EzExploit/...rd.jar
windows7-x64
1EzExploit/...rd.jar
windows10-2004-x64
7EzExploit/...rd.bat
windows7-x64
1EzExploit/...rd.bat
windows10-2004-x64
7EzExploit/...rt.jar
windows7-x64
1EzExploit/...rt.jar
windows10-2004-x64
7EzExploit/...nd.jar
windows7-x64
1EzExploit/...nd.jar
windows10-2004-x64
7EzExploit/...st.jar
windows7-x64
1EzExploit/...st.jar
windows10-2004-x64
7EzExploit/...nd.jar
windows7-x64
1EzExploit/...nd.jar
windows10-2004-x64
7EzExploit/...er.jar
windows7-x64
1EzExploit/...er.jar
windows10-2004-x64
7EzExploit/...ml.jar
windows7-x64
1EzExploit/...ml.jar
windows10-2004-x64
7EzExploit/...ix.jar
windows7-x64
1EzExploit/...ix.jar
windows10-2004-x64
7Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
EzExploit/ezexploit_standard.jar
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
EzExploit/ezexploit_standard.jar
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
EzExploit/launch-standard.bat
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
EzExploit/launch-standard.bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
EzExploit/modules/cmd_alert.jar
Resource
win7-20231023-en
Behavioral task
behavioral6
Sample
EzExploit/modules/cmd_alert.jar
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
EzExploit/modules/cmd_find.jar
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
EzExploit/modules/cmd_find.jar
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
EzExploit/modules/cmd_list.jar
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
EzExploit/modules/cmd_list.jar
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
EzExploit/modules/cmd_send.jar
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
EzExploit/modules/cmd_send.jar
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
EzExploit/modules/cmd_server.jar
Resource
win7-20231025-en
Behavioral task
behavioral14
Sample
EzExploit/modules/cmd_server.jar
Resource
win10v2004-20231023-en
Behavioral task
behavioral15
Sample
EzExploit/modules/reconnect_yaml.jar
Resource
win7-20231020-en
Behavioral task
behavioral16
Sample
EzExploit/modules/reconnect_yaml.jar
Resource
win10v2004-20231020-en
Behavioral task
behavioral17
Sample
EzExploit/plugins/RconFix.jar
Resource
win7-20231020-en
Behavioral task
behavioral18
Sample
EzExploit/plugins/RconFix.jar
Resource
win10v2004-20231023-en
General
-
Target
EzExploit/modules/reconnect_yaml.jar
-
Size
6KB
-
MD5
d1fde0d321918adc22002d9072ef23ca
-
SHA1
efd66687ec71fa74dd1e6bf438615214abb5fee9
-
SHA256
23147bfa63e2ac2add7c57480ab579f6a3d3b6091d480e712b610b1b9b79a4e4
-
SHA512
ba876f61d6484db3d441bd7004d03a5d6afa97085fd46d8684d6ba6648af083a4d6300a77f8e16dff754c63158f7be8ee9de81443ae06cb1259c3aed611fca85
-
SSDEEP
96:f6HZWp6AqfLNhLLO2cE/BZtit/violx5gSvnG0/KAuKNzLYsyusW4s7NqfyaDW:f650uzNhs4titiolB/GXALWsJsVM8PDW
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4104 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3696 wrote to memory of 4104 3696 java.exe 87 PID 3696 wrote to memory of 4104 3696 java.exe 87
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\EzExploit\modules\reconnect_yaml.jar1⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD55a2c216ad52b87541d673c6ceab3a446
SHA17e248a2ee02d29a7fdab28f811aa6cfefdcf70a6
SHA256dddadd222b5a57b7df3bc27e729e0ad928307722bf42033e89de914dae25cbde
SHA51214c0aba8856cf14bc012d8f131f486c127e751066dc3696ec7bff862de2fc189f9f57e93c7f2fbb7734c8fa1bdd6ef7ab8c0508e353b677c77f4d51e7a570deb