Analysis
- max time kernel
92s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
29/11/2023, 10:29
General
- Target 20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7.jar
- Size 219KB
- Sample231129-mjd12sff71
- SHA256 20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/4744-47-0x00000285AF830000-0x00000285AF840000-memory.dmp
memory/4744-12-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp
memory/4744-22-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-26-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-33-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp
memory/4744-38-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-43-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp
memory/4744-44-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-2-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-46-0x00000285AF810000-0x00000285AF820000-memory.dmp
memory/4744-50-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-49-0x00000285AF890000-0x00000285AF8A0000-memory.dmp
memory/4744-48-0x00000285AF870000-0x00000285AF880000-memory.dmp
memory/4744-51-0x00000285AF8A0000-0x00000285AF8B0000-memory.dmp
memory/4744-52-0x00000285AF8B0000-0x00000285AF8C0000-memory.dmp
memory/4744-53-0x00000285AF8C0000-0x00000285AF8D0000-memory.dmp
memory/4744-54-0x00000285AF8D0000-0x00000285AF8E0000-memory.dmp
memory/4744-55-0x00000285AF8F0000-0x00000285AF900000-memory.dmp
memory/4744-56-0x00000285AF590000-0x00000285B0590000-memory.dmp
memory/4744-57-0x00000285AF590000-0x00000285B0590000-memory.dmp