Analysis
- max time kernel
149s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
29/12/2023, 23:43
General
- Target 075383dec7f7f734703c07ad452ec516.jar
- Size 107KB
- Sample231229-3qlmgacbf3
- SHA256 1aa7af496d4c49c35a9bd663783a6ecf3d076d774ac7a53ecfe93b1837d05710
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\075383dec7f7f734703c07ad452ec516.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3176-4-0x000001B31B590000-0x000001B31C590000-memory.dmp
memory/3176-12-0x000001B31B570000-0x000001B31B571000-memory.dmp
memory/3176-18-0x000001B31B590000-0x000001B31C590000-memory.dmp
memory/3176-28-0x000001B31B570000-0x000001B31B571000-memory.dmp
memory/3176-39-0x000001B31B8A0000-0x000001B31B8B0000-memory.dmp
memory/3176-41-0x000001B31B840000-0x000001B31B850000-memory.dmp
memory/3176-44-0x000001B31B870000-0x000001B31B880000-memory.dmp
memory/3176-45-0x000001B31B880000-0x000001B31B890000-memory.dmp
memory/3176-46-0x000001B31B890000-0x000001B31B8A0000-memory.dmp
memory/3176-47-0x000001B31B8B0000-0x000001B31B8C0000-memory.dmp
memory/3176-43-0x000001B31B860000-0x000001B31B870000-memory.dmp
memory/3176-48-0x000001B31B590000-0x000001B31C590000-memory.dmp
memory/3176-42-0x000001B31B850000-0x000001B31B860000-memory.dmp
memory/3176-40-0x000001B31B8C0000-0x000001B31B8D0000-memory.dmp
memory/3176-38-0x000001B31B820000-0x000001B31B830000-memory.dmp
memory/3176-37-0x000001B31B810000-0x000001B31B820000-memory.dmp
memory/3176-35-0x000001B31B590000-0x000001B31C590000-memory.dmp
memory/3176-49-0x000001B31B590000-0x000001B31C590000-memory.dmp