b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2

Resubmissions

09/12/2023, 12:43

231209-px2elshhd910

09/12/2023, 12:43

231209-pxxresgdbn10

09/12/2023, 12:42

231209-pxr6yagdbl10

09/12/2023, 12:17

231209-pf2daagccq10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2023, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07900321100.jar
Size 126KB
Sample231209-pf2daagccq
SHA256 b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
MD5 5f73f282fd6efe7a9c426b3782a99483
SHA1 d9d2945053aab6d20b4154c763780300f867ade9
SHA512 ce11ba9e1b7e1c084fe6328b0c4dcb753b878befd1453cebf47447475787dd5945d6b3a81e46ecbe29630e3cefb8f5c2ddc0e3b73da3781508da7b3250fbc3a9
SSDEEP 1536:lNI8XP1F0tURwTD9OaEPXs0JJSSk48P+KMm2gpEg0HaoUX1XgP4pRS8fP4HRsMu+:lNRyOPbJ6rJCg0Nd4phfP42MlF/E4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3484	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3484	4816	java.exe	90
PID 4816 wrote to memory of 3484	4816	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\07900321100.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 c8e1b6c978c16d2deed31b6841c574e5242a24e788a7a99a2e69f07d4eb79ab9
MD5 622d23f5f8d760c0a8a81d284856392e
SHA1 31bd93b4862e278fd923eb0fcc47472a2446ee20
SHA512 3c0974cec070d35da41979e0100794e585370e494dc0bd9221daa79dd7b320b81a610c61afe14971eefdeab18851b47be6af77b9293b5a2fc415399b1f4ad4b8
MD5 SHA1 SHA512

Submit Download

memory/4816-56-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-12-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-17-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-25-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-30-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-37-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-43-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-47-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-4-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-51-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-64-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-63-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-57-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-81-0x0000021AC88C0000-0x0000021AC88C1000-memory.dmp

Download

memory/4816-102-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-109-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-112-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-119-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-127-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

memory/4816-138-0x0000021ACA1A0000-0x0000021ACB1A0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads