b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2

Resubmissions

09/12/2023, 12:43

231209-px2elshhd910

09/12/2023, 12:43

231209-pxxresgdbn10

09/12/2023, 12:42

231209-pxr6yagdbl10

09/12/2023, 12:17

231209-pf2daagccq10

Analysis

max time kernel
287s
max time network
289s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2023, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07900321100.jar
Size 126KB
Sample231209-px2elshhd9
SHA256 b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
MD5 5f73f282fd6efe7a9c426b3782a99483
SHA1 d9d2945053aab6d20b4154c763780300f867ade9
SHA512 ce11ba9e1b7e1c084fe6328b0c4dcb753b878befd1453cebf47447475787dd5945d6b3a81e46ecbe29630e3cefb8f5c2ddc0e3b73da3781508da7b3250fbc3a9
SSDEEP 1536:lNI8XP1F0tURwTD9OaEPXs0JJSSk48P+KMm2gpEg0HaoUX1XgP4pRS8fP4HRsMu+:lNRyOPbJ6rJCg0Nd4phfP42MlF/E4
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4692	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4692	3240	java.exe	88
PID 3240 wrote to memory of 4692	3240	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\07900321100.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 96c01133e5eb46fbdce45da7629adf66e73cdd9693c690867dc7ca7e7c23f154
MD5 026c68f5fc65d6ed71cfc01612f83d12
SHA1 868db8a041f26de0994bcc87218a1e763918bc71
SHA512 da791fbeb0b1716c288e7d7f33bc234d93a57d4a83a3ee734394e812acd4f8014e7c494e3b8b8920aff3fb4be6f5aca7a764a78a25644c83f26e56d55d02e216
MD5 SHA1 SHA512

Submit Download

memory/3240-64-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-76-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-17-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-4-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-31-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-37-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-42-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-47-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-12-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-62-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-24-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-77-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-86-0x000001E5BAE00000-0x000001E5BAE01000-memory.dmp

Download

memory/3240-97-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-101-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-111-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-116-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-120-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

memory/3240-139-0x000001E5BC680000-0x000001E5BD680000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads