59c9f5bbdf0913d7f877e6859adfb266bee0a64395308b588a94c2eb8c27a334

Analysis

max time kernel
92s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 10:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7.jar
Size

219KB
MD5

57c583846083e93f56990a97b39cffd8
SHA1

f34af3fc57a8f0cdc7b0692de369b45d12711918
SHA256

20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7
SHA512

63662cc3fadc40a15ef57f70e7ca579a6bc11dd7fce6afeefbfd1613ce93edd2198d16f23c8ee65a7a6d786da70c0669e03b6edb8785bc25e3b18bc4ba7abc16
SSDEEP

3072:0NGIpzASCIWcBzO3hU/17b2IiT2NHkdHiYcj+uCO+cK41A4EJZGWxSFIp/oOC7+A:zIRBwG/bCYTR1A4CZTSKBCuKbb

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3656 icacls.exe

pid	process
3656	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4744 wrote to memory of 3656 4744 java.exe icacls.exe
PID 4744 wrote to memory of 3656 4744 java.exe icacls.exe

description	pid	process	target process
PID 4744 wrote to memory of 3656	4744	java.exe	icacls.exe
PID 4744 wrote to memory of 3656	4744	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\20f218010b4a83ad4af68bfe387b4275a86eef84354e279bde5b11c07b7433a7.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5b77c3a736af668c5627a2ef2475163e

SHA1
1f171275fb8dc63d31241a13f24e212169ba8d47

SHA256
7852b9daba8b39b61dcc41710587bed84758982c7818a54ca9cfdbd4ec3dcb04

SHA512
0359fcaa127d9088ec3ad70972e28364bd3621be20a22136724c1b082a9866d5429b39eda2bdff516ca425c38efa2d24847f7c22e1fa95165e68a2a9bdff0c22

Download Submit
memory/4744-47-0x00000285AF830000-0x00000285AF840000-memory.dmp

Filesize
64KB

Download
memory/4744-55-0x00000285AF8F0000-0x00000285AF900000-memory.dmp

Filesize
64KB

Download
memory/4744-22-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-26-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-33-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp

Filesize
4KB

Download
memory/4744-38-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-43-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp

Filesize
4KB

Download
memory/4744-48-0x00000285AF870000-0x00000285AF880000-memory.dmp

Filesize
64KB

Download
memory/4744-57-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-12-0x00000285ADCA0000-0x00000285ADCA1000-memory.dmp

Filesize
4KB

Download
memory/4744-44-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-49-0x00000285AF890000-0x00000285AF8A0000-memory.dmp

Filesize
64KB

Download
memory/4744-50-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-51-0x00000285AF8A0000-0x00000285AF8B0000-memory.dmp

Filesize
64KB

Download
memory/4744-52-0x00000285AF8B0000-0x00000285AF8C0000-memory.dmp

Filesize
64KB

Download
memory/4744-53-0x00000285AF8C0000-0x00000285AF8D0000-memory.dmp

Filesize
64KB

Download
memory/4744-54-0x00000285AF8D0000-0x00000285AF8E0000-memory.dmp

Filesize
64KB

Download
memory/4744-2-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-56-0x00000285AF590000-0x00000285B0590000-memory.dmp

Filesize
16.0MB

Download
memory/4744-46-0x00000285AF810000-0x00000285AF820000-memory.dmp

Filesize
64KB

Download