d82f76ab1d5ce45980e6190eb3603d73f8dff7e71b0f2f321c5a4a8578a80647

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugins-jetbrains/hideme.jar
Size

7KB
MD5

cdab6a30b0949a741f13935f5483c303
SHA1

729d00e4fa04ca49c00b5b6aa60706dfadd5644e
SHA256

fa14c735ab9fed3f3a5df0dc78a5d38ae0a146099ddc858197e9f528bd996c40
SHA512

bf155c0b062fe9c7c237f9b0329a155387b7294fae7c7ed73e41e9528f119ccc513855329f6e91e62106b589c8b215d981ed11f2f89c7e13c06fbdcf7d6d1ee8
SSDEEP

96:ohFTqRYuFhXQ5GeiCGkeFUgbH44yY8NVFubQLwNUmvHh18OiPKwChme:gFuRDiiCSbH4u8ZuvOMBGOiEme

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3320	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 3320	3292	java.exe	91
PID 3292 wrote to memory of 3320	3292	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\plugins-jetbrains\hideme.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5f9ab5cc39be40f157122745a81f3d29

SHA1
fd3e3c370a02999492cf62ed7c79a0cab2f936f3

SHA256
62fd1b2cee1f987aa053883abf8216457ff9a3bc5acb4c4d84fc796fd813e96a

SHA512
9f52c28800d693fa51467abcc9dae71103a6f48c1683013017eeb045ef1c208c7ec37d47bdad6fc95632711a4a7e6cd7d696d91a9f1bfa1abd3f31fc10c92c89

Download Submit
memory/3292-4-0x000001AE607E0000-0x000001AE617E0000-memory.dmp

Filesize
16.0MB

Download
memory/3292-12-0x000001AE5EEE0000-0x000001AE5EEE1000-memory.dmp

Filesize
4KB

Download