d82f76ab1d5ce45980e6190eb3603d73f8dff7e71b0f2f321c5a4a8578a80647

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ja-netfilter.jar
Size

47KB
MD5

2fa1b1364515dce93eb67c423b570deb
SHA1

2a723c2ef30be4a5c167c6639bf9ec0b9c7e7ca2
SHA256

3acc4e9d91793f6909458a4761b75b6da45c8868e75dca33c9fec63659202995
SHA512

0b6cf7caf6d48419251d0aa1ccf280536eb20b1f108f874a9ce86943601c2317833031578fc869366e3bc40dedfabfd64527598ea63b879bc77f82a9a218766b
SSDEEP

768:Oh7IDIGjwZyHIwcctMtI+xIfo1UC6cB+P9146lp3fbYHfkWvQdptYc4klY:KSIG0ZuIQMtI+xIrTcB034673fbgvYI

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
548	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 548	4112	java.exe	89
PID 4112 wrote to memory of 548	4112	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ja-netfilter.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
13c0d1899aabc65df5d3f5176afe827e

SHA1
57eb4c6a336996ad241e456d38940d7b82d7d204

SHA256
c5fa96437b5f21db91c6a9fa3d1c78567d4cc2afc9a50efc20ffb02d827df7d5

SHA512
27c62e020a59dc9c6d97de7298310d81f2989fedb7e2278102041ce2798ae0ec9bc4dc74a112a00f052ba39045711d3670b7d040da667236a31b91cb223b0ac5

Download Submit
memory/4112-4-0x000001CB80000000-0x000001CB81000000-memory.dmp

Filesize
16.0MB

Download
memory/4112-12-0x000001CBF9BA0000-0x000001CBF9BA1000-memory.dmp

Filesize
4KB

Download