Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-12-2023 05:14

General

  • Target

    a4d701ab9770dada452925a014163a36.jar

  • Size

    88KB

  • MD5

    a4d701ab9770dada452925a014163a36

  • SHA1

    081bbee5fda2159af6a0ec6a6db11bbba8e985f7

  • SHA256

    48ba29328ad82dfd72bfac6eede576867ebf6f39ec0a7f1691201d1a10d299c9

  • SHA512

    42ac4f0c615caefcedcdcde5e4ba25d612171017200cb46d89c692e88ca3d484f92d7ce0be6557665b5bd07e8bd47491b87dc75d9c186d39ecc304afd46feccd

  • SSDEEP

    1536:wQxJoWyS7JljI8hGD767DzUWVFXUQugUt8ms4sRuZhuO8bNqg1r:wkvPhPXhugUKghuO8bN/r

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\a4d701ab9770dada452925a014163a36.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2380-4-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-12-0x0000018B33560000-0x0000018B33561000-memory.dmp

    Filesize

    4KB

  • memory/2380-17-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-32-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-42-0x0000018B33560000-0x0000018B33561000-memory.dmp

    Filesize

    4KB

  • memory/2380-43-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-46-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-47-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-54-0x0000018B34F90000-0x0000018B34FA0000-memory.dmp

    Filesize

    64KB

  • memory/2380-55-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB

  • memory/2380-56-0x0000018B34BA0000-0x0000018B35BA0000-memory.dmp

    Filesize

    16.0MB