3f662d2fcb48c2c6ae0bcf595870a0b38198a23dd5040765893b6d8f43c872f6

Analysis

max time kernel
152s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adb-toolkit/bin/recovery/tools/zip/SGH-T989_DARKSIDE.CACHE.WIPE.jar
Size

1.2MB
MD5

b00eba3c7f647b6235aa32a11f25fc2a
SHA1

5b66c8b9587f68c20191ddd4664178cbf2c84b57
SHA256

393e4ea7c9c360010b4a179f91b7ba97e2f21d4a3dd02b1f57ba173639806d0d
SHA512

2410f33c7a323425e8ac4fdcf6a02d04f32222c839563ba76d0aee5610713eb9f9a1eac9a7dd0d608bdf2bf2acc4f7ba98c564d245ec54ad1383b08997bac8d7
SSDEEP

24576:bB5rCit5o0hmNOcg6UQwAWH0eQUAHoiKvXUIdET3DgSDiJhC6+PqD:lMo5wg9QwANMHdET3DgRLCS

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2916	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2916	1424	java.exe	41
PID 1424 wrote to memory of 2916	1424	java.exe	41

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\adb-toolkit\bin\recovery\tools\zip\SGH-T989_DARKSIDE.CACHE.WIPE.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f6c4d7de96c8f5405ac10bbaa71bd686

SHA1
47ebf4bdb2646f7bd2566b8d555221e0e2ada497

SHA256
16b3bdae26e27a94af25893182c031af6c34ffa51fb33f854cda8a1b67da57f0

SHA512
2d1476a00670502c0d16b8987d4bedb39eacc50ade813f3420a0aca0b0fc6966234825f5049fdbde748d827ef17a8529ae3d70ba71d8b3a61956c820708fa6e8

Download Submit
memory/1424-4-0x00000219909E0000-0x00000219919E0000-memory.dmp

Filesize
16.0MB

Download
memory/1424-11-0x00000219909C0000-0x00000219909C1000-memory.dmp

Filesize
4KB

Download
memory/1424-13-0x00000219909E0000-0x00000219919E0000-memory.dmp

Filesize
16.0MB

Download