Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 14:33

General

  • Target

    000122223.jar

  • Size

    102KB

  • MD5

    d375b26e07150dc37dae2ce7d22a586b

  • SHA1

    8d4ec9d1b48c5cd2ffaeae674c8e93b489a5c171

  • SHA256

    56f0a10c33da16a1d597d2772bca21ae3e39cc179cf31eef3fa623480580bb61

  • SHA512

    6b388b840e70b988345be952efdce79d830934abb49dcbc6060441a0cd58014de4cd4ed19743adce77ee7af0133fe7db00d10a5d578754fb8d714e9f8925b3ec

  • SSDEEP

    1536:cjSW+gbZj1hXLp8tmGiwvzk//zNpPShwbRWNcRcqrdHc4CSshc/6yN6:cjSW+QZjHX6tgGadAqp8nSsnyM

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\000122223.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3664-2-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-11-0x000001920F980000-0x000001920F981000-memory.dmp

    Filesize

    4KB

  • memory/3664-18-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-28-0x000001920F980000-0x000001920F981000-memory.dmp

    Filesize

    4KB

  • memory/3664-29-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-42-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-48-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-51-0x000001920F980000-0x000001920F981000-memory.dmp

    Filesize

    4KB

  • memory/3664-55-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-56-0x000001920F980000-0x000001920F981000-memory.dmp

    Filesize

    4KB

  • memory/3664-78-0x000001920F980000-0x000001920F981000-memory.dmp

    Filesize

    4KB

  • memory/3664-159-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-161-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-162-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-163-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-166-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-168-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-169-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-186-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-190-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-197-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-201-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB

  • memory/3664-219-0x0000019211390000-0x0000019212390000-memory.dmp

    Filesize

    16.0MB