Resubmissions

02/11/2023, 15:01

231102-sdwxkafe89 7

02/11/2023, 14:58

231102-scexnade9x 7

Analysis

  • max time kernel
    131s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2023, 14:58

General

  • Target

    EzExploit/modules/cmd_alert.jar

  • Size

    5KB

  • MD5

    56416bffc290b5531375807e134053f4

  • SHA1

    cc706ad8d6b9bf02154df232d1b9574b892afd2f

  • SHA256

    785152401573f49a3b1d9a3cf50edb89b971acf0bff4f50c1ba93678b15e92cb

  • SHA512

    e798017ac689d8cb4f9219b84d85896ac6852762efba859af5e7442b22bf0b81fcdb5e117342e7b309a4c0b7bfed8e0304669b1c70e565b69b05610852b45bb4

  • SSDEEP

    96:n6H/zjSMnsoU6BuXvGLHvoWywguYPHbSDM9TH5Yvp:n6r+MskcXOLb0uYjSM5Yvp

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\EzExploit\modules\cmd_alert.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    580ec3cc1852b5825d80a3da3d1afe3b

    SHA1

    7b9d2b7616a42c3ec337a066f169e449a0b78b77

    SHA256

    984dae82a2b52ba95ae06a08142f43d83f7db67f4c75fd57cb61fea9c9b71708

    SHA512

    5858fc1c6bc6cdaae745b7036a753af95024aa0ef97aa1cc99fa23e9dc7911144bb18cce5ec2572d5eff6443c83a9e1abf8b5af46f3227f720eb6619128209e0

  • memory/396-2-0x0000015EE6320000-0x0000015EE7320000-memory.dmp

    Filesize

    16.0MB

  • memory/396-5-0x0000015EE6320000-0x0000015EE7320000-memory.dmp

    Filesize

    16.0MB

  • memory/396-13-0x0000015EE4AF0000-0x0000015EE4AF1000-memory.dmp

    Filesize

    4KB