Resubmissions

02/11/2023, 15:01

231102-sdwxkafe89 7

02/11/2023, 14:58

231102-scexnade9x 7

Analysis

  • max time kernel
    149s
  • max time network
    269s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2023, 15:01

General

  • Target

    EzExploit/plugins/RconFix.jar

  • Size

    2KB

  • MD5

    bb0199fad177d12ac638d2da61f9a4df

  • SHA1

    25ee0d14cdc31a214e31c042054c82cdd9ad5176

  • SHA256

    87e3c42b1cdba0b17983ee04ed656d94ebc2101923f4ba4f6dd96dea83705751

  • SHA512

    26aa5c1f5e1fb172bbd65fd0c91da8e321c982027c7f26a27f2ce7454d8bb9493fc103180e094bfb87e7295217d6dd57b8fbf0ce8df9f5428e6e80c8498e672b

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\EzExploit\plugins\RconFix.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/684-2-0x000001EC10270000-0x000001EC11270000-memory.dmp

    Filesize

    16.0MB

  • memory/684-9-0x000001EC10270000-0x000001EC11270000-memory.dmp

    Filesize

    16.0MB

  • memory/684-12-0x000001EC0E990000-0x000001EC0E991000-memory.dmp

    Filesize

    4KB