1f9a4eb72e20eb5aa2d52d3c3280f50851d2af2f3b19295a57aed8bec5ec1185

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2023, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
amazon.jar
Size 217KB
Sample231122-qpyt7add5v
SHA256 1f9a4eb72e20eb5aa2d52d3c3280f50851d2af2f3b19295a57aed8bec5ec1185
MD5 580a1eb58a25e919fd6ada88b3ae939a
SHA1 77e82293e17359ddafe9d6590e3e01eebbf2cbc2
SHA512 21d550f5ad8fba14fd145c21d7bd84e21609c8218f288ea63af54c062c3c7d0dc76bb7c128be2985e108c3ce70f274911be354544172c15bf2502a925f2cb512
SSDEEP 6144:Nig9TLwsrdn+Szf+6s1Am9a1LQl4YUEs7L3s9F:UePwsPy6sA9bYQrGF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4380	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4380	3504	java.exe	89
PID 3504 wrote to memory of 4380	3504	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\amazon.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 45a64f1355772a409ef8c09ff4726b079dbcb8cb30c2d849259132300bd91161
MD5 89ff02f8940f306d1b0627747af5fdb5
SHA1 e20feec58a2d0969fcb17ffcbdaadd03b891eff0
SHA512 c2f7957ca6b65122a1261c9cb8e68e85934db09ae20260ec060b585c9b3008c2d6311b4538bcebf4a9be88da8db922c47cf290aa7e923d2d39842ef0f3cd50fd
MD5 SHA1 SHA512

Submit Download

memory/3504-4-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

memory/3504-17-0x00000200EAB40000-0x00000200EAB41000-memory.dmp

Download

memory/3504-20-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

memory/3504-27-0x00000200EAB40000-0x00000200EAB41000-memory.dmp

Download

memory/3504-31-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

memory/3504-44-0x00000200EAB40000-0x00000200EAB41000-memory.dmp

Download

memory/3504-48-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

memory/3504-53-0x00000200EAB40000-0x00000200EAB41000-memory.dmp

Download

memory/3504-58-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

memory/3504-66-0x00000200EC3D0000-0x00000200ED3D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads