Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20231127-en - resource tags
- submitted
09/12/2023, 14:19
General
- Target 07900321100.jar
- Size 126KB
- Sample231209-rmtywsacg8
- SHA256 b8d23d8f9495c315a1a7c8daf8284f8407f0987d1b4f1d2c2880fa1fc62572a2
Score
7/10
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\07900321100.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/3012-18-0x0000018DCFD40000-0x0000018DCFD50000-memory.dmp
memory/3012-34-0x0000018DCFE40000-0x0000018DCFE50000-memory.dmp
memory/3012-50-0x0000018DD8150000-0x0000018DD8151000-memory.dmp
memory/3012-52-0x0000018DD8180000-0x0000018DD8181000-memory.dmp
memory/3012-53-0x0000018DD8180000-0x0000018DD8181000-memory.dmp
memory/3012-54-0x0000018DD8290000-0x0000018DD8291000-memory.dmp
memory/4576-4-0x000002D500000000-0x000002D501000000-memory.dmp
memory/4576-12-0x000002D57A540000-0x000002D57A541000-memory.dmp
memory/4576-16-0x000002D500000000-0x000002D501000000-memory.dmp
memory/4576-17-0x000002D500000000-0x000002D501000000-memory.dmp