d82f76ab1d5ce45980e6190eb3603d73f8dff7e71b0f2f321c5a4a8578a80647

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugins-jetbrains/url.jar
Size

4KB
MD5

6b181e5b8255db4cd9beb1c6af5f420e
SHA1

b1bebbee8d98218db5794f596001b8b7427ae0c7
SHA256

ce5a83aee31153cca30274ac94467b316edea8cb28acf72f52f5a72d455b1b43
SHA512

26dabc145da4a987744ab86d600ab81482771fb8fc99933828104d4698f4dc407eb97281a36f01d5852fc2209d0092f10b7d23d62db8f7e456f8d2d0a108ce7a
SSDEEP

96:KPP4+DT0nUeKLB3pWsWJMN4j4pbxYQcTxBWUw3/6ws3U:IPLTLRZWsN+6xATHO3iN3U

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2212	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 2212	4200	java.exe	89
PID 4200 wrote to memory of 2212	4200	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\plugins-jetbrains\url.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f9d52451318a3390832b8ae5a42ecd0a

SHA1
68673bc6794b4583bcd199af276a850afa234660

SHA256
de367734a0530ebaabb929db4a6b987128b28489fcd5a876652a5fe53d93a5cd

SHA512
23bc769722c2cd791ac2b6c601ef939a0e6233f52c909a925d373a6944004f8463e0721b905b8400946ddcd83a1017a47f7ece76f152f126d895bd2ec0768289

Download Submit
memory/4200-8-0x0000014D00000000-0x0000014D01000000-memory.dmp

Filesize
16.0MB

Download
memory/4200-12-0x0000014D73600000-0x0000014D73601000-memory.dmp

Filesize
4KB

Download