b377147c1bfb1f4f96ef04a6a4f2220c2f2cd14c28eb7b39e4da1ef3ff4f9b9e

Resubmissions

02/11/2023, 15:01

231102-sdwxkafe89 7

02/11/2023, 14:58

231102-scexnade9x 7

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EzExploit/modules/cmd_find.jar
Size

4KB
MD5

7b5e43fbeeadb29e464b83438b364b41
SHA1

7f1ec5e5d4a1638b90bae3850c91c7172dbbd01f
SHA256

ce8061e18a7adda05365eb3fbc46dd8860725ee8d529b91c1362aabb24e6915d
SHA512

6721f7bded1786edba9792456348fd94b3cb302ff784057a779dad7682491a3a842d5f05e60d0c3c2f3506d5066afd367159700309fec2e6fa280d83f478f71b
SSDEEP

96:v6HXGuBMb/E2TWtwRx4/m/5KoE4TpZ06cB1O2uWD:v63G7bEkWtwRx//5tEYEia

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1968	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1968	2204	java.exe	90
PID 2204 wrote to memory of 1968	2204	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\EzExploit\modules\cmd_find.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
27db59d097416a83e59291621b47fdf4

SHA1
1bffe28f245e8f2220284d074c33674abc285bbb

SHA256
fb24b96ea2fe566b2c17b145f8209746a3c4f55b9358d837bcaa3be61df97f24

SHA512
3d2268e7688943cbb2e3eeb53f1c39c096272a5ef566c5410a6ece326692d38abf2915578ac236232f4fbaff03bf1e6b28e03f6b1b05ca242fb2a97d524f6878

Download Submit
memory/2204-4-0x000001BA8E400000-0x000001BA8F400000-memory.dmp

Filesize
16.0MB

Download
memory/2204-12-0x000001BA8E3E0000-0x000001BA8E3E1000-memory.dmp

Filesize
4KB

Download