1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd

Analysis

max time kernel
520s
max time network
530s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe
Size

6.6MB
MD5

ac5f01840f41d7ad5e7ff797721086b1
SHA1

3c12e4b3186e7242acc80fccd6723342eaf6b55f
SHA256

1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd
SHA512

144d314cbe33e93c494055046236cafa9cbbb907461a2757f649645c8dc3cfc93685e055afc0fdf880ce379bcba28642b4c28342a0f468cb75948f65de019262
SSDEEP

98304:aJi1+92/QLnBHRKiTBrHJWGs2NyqeoNE/7SRYY2VymGu/m6zHAlA64TRRbCvk4:ag1++knBHRKiTVHJack+YlGlSRRbCvk4

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4820	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3056	1196	1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe	87
PID 1196 wrote to memory of 3056	1196	1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe	87
PID 3056 wrote to memory of 4820	3056	javaw.exe	88
PID 3056 wrote to memory of 4820	3056	javaw.exe	88

C:\Users\Admin\AppData\Local\Temp\1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe
"C:\Users\Admin\AppData\Local\Temp\1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\1e2d03f09f0ea1b137e6434bdf3644f65886e9f3dcdd7d6f4b502bd8b6850ccd.exe" org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5b3cb56dde0c197ece58f2397a31d001

SHA1
bbc8a72b284e052d69955c84a2c01708e29bcffe

SHA256
b205a152e081c95f8357e87ca3f8e864d981f41b3377d3ff1104359c5df76d7d

SHA512
08765b7085e1313f64511c4d0fb00648a4f62d5724d2806c1c5526b5084c177f6e6ceb548c8d2d4220039e840e581301f749a56d48c6fb335766354ddcb14f39

Download Submit
memory/1196-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3056-7-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download
memory/3056-13-0x00000137294B0000-0x00000137294B1000-memory.dmp

Filesize
4KB

Download
memory/3056-14-0x00000137294B0000-0x00000137294B1000-memory.dmp

Filesize
4KB

Download
memory/3056-18-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download
memory/3056-25-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download
memory/3056-33-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download
memory/3056-37-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download
memory/3056-40-0x000001372AD70000-0x000001372BD70000-memory.dmp

Filesize
16.0MB

Download