8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38

Resubmissions

29-12-2023 08:01

231229-jw3ndsgah2 7

29-12-2023 07:56

231229-jsp8wscgfm 7

Analysis

max time kernel
142s
max time network
70s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_874D1567799B7B9AFBEE570F7726949B.jar
Size

542KB
MD5

bd130f4d29db271be2f06865e06fbf05
SHA1

9b2d7530512307c33437745b3fed9862ef887ddf
SHA256

6708cbd5003ebabc78c07db370a31e48a37dd84c854df70c97d658c41c20c50a
SHA512

7b145b7a0320b8e09108301b3e5ec99035ef309222da30574025de455ddbd9be2311a193bf889b72d167ffe4ff17ecb316df962574dd1bd6399d67fceecf22d8
SSDEEP

12288:6WYfvZKpvMHb9+ALF3TEYcqAprfFPzZY4jgiovcfUR:6J0h+F3gY1srfjXovcQ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2600	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2600	1856	java.exe	34
PID 1856 wrote to memory of 2600	1856	java.exe	34

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\_874D1567799B7B9AFBEE570F7726949B.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d10f40ee54fe8e594096a650556fe5f6

SHA1
63862cbd4631c932c8274b9badd8d8a08f01c97e

SHA256
dc3c73e1ba7de42660b984e05bef6359fdaa6b30d83e3c6ed24578acfacd6a90

SHA512
6c1e4e9b17742688be10597eec96da3387d737726f9b9544752da4299075ddd430f90d4433526ef9454bd96adc9ee8e98612d2667fbfca34408aeb7b4714ab7d

Download Submit
memory/1856-4-0x00000189E41B0000-0x00000189E51B0000-memory.dmp

Filesize
16.0MB

Download
memory/1856-11-0x00000189E29E0000-0x00000189E29E1000-memory.dmp

Filesize
4KB

Download