b377147c1bfb1f4f96ef04a6a4f2220c2f2cd14c28eb7b39e4da1ef3ff4f9b9e

Resubmissions

02/11/2023, 15:01

231102-sdwxkafe89 7

02/11/2023, 14:58

231102-scexnade9x 7

Analysis

max time kernel
285s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2023, 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EzExploit/modules/cmd_find.jar
Size

4KB
MD5

7b5e43fbeeadb29e464b83438b364b41
SHA1

7f1ec5e5d4a1638b90bae3850c91c7172dbbd01f
SHA256

ce8061e18a7adda05365eb3fbc46dd8860725ee8d529b91c1362aabb24e6915d
SHA512

6721f7bded1786edba9792456348fd94b3cb302ff784057a779dad7682491a3a842d5f05e60d0c3c2f3506d5066afd367159700309fec2e6fa280d83f478f71b
SSDEEP

96:v6HXGuBMb/E2TWtwRx4/m/5KoE4TpZ06cB1O2uWD:v63G7bEkWtwRx//5tEYEia

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
952	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 952	3284	java.exe	91
PID 3284 wrote to memory of 952	3284	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\EzExploit\modules\cmd_find.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
db9ebdd49795611578e76c643e37bda3

SHA1
a371a9ab199619d44ba11bf6c543cacaeb2ce3d7

SHA256
e2850ea2b920ff2872777e153d0b70a97e23e469360888257bfc7a5ef5a9c8c8

SHA512
f8f20322cf8b864137d79e853cb7db3e4de7a22a22e076b71473a16e1d874edc85ce299c3be9b174d16bd3a235cfb6e007414cd2ad881b8172c7330c73bc76eb

Download Submit
memory/3284-2-0x0000015C70FB0000-0x0000015C71FB0000-memory.dmp

Filesize
16.0MB

Download
memory/3284-10-0x0000015C70FB0000-0x0000015C71FB0000-memory.dmp

Filesize
16.0MB

Download
memory/3284-13-0x0000015C70F90000-0x0000015C70F91000-memory.dmp

Filesize
4KB

Download