8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38

Resubmissions

29-12-2023 08:01

231229-jw3ndsgah2 7

29-12-2023 07:56

231229-jsp8wscgfm 7

Analysis

max time kernel
201s
max time network
255s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_8FCD084FEA1DEADAC814BE0A01BAFCB4.jar
Size

81KB
MD5

1ee61ab8c24686d0ff45bbb73fd61419
SHA1

07a7f26eed69e5f9c29996397972dfbe050f4517
SHA256

2b21fe9f6482fe192756e960a4aeb134ce1a44369ca36b792c6d18da489921cb
SHA512

f04f57a1a6bd14538365a77631ba7e7bd1b0854f79ef05b7ca6019b59816df70a525933df281cbf1683ee8806f52e3e6fe0182fef1cc28fe452b3da41b69f27c
SSDEEP

1536:OZC254HSv+PzoClQ/KyCyiu8nBByLVe+RvuTPucHD7PCVTdLgUkCK6:uCeZv+roCliCETLTuu8D72TdLVK6

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4100	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 4100	920	java.exe	100
PID 920 wrote to memory of 4100	920	java.exe	100

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\_8FCD084FEA1DEADAC814BE0A01BAFCB4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1b37df0d241a226f8bfdeb7e0a27ab8b

SHA1
9001d80548e4b03976a727c1df51adc50b24b6b1

SHA256
cb11889fac219e8c6ce936ca676359592d47bda32c755d5984750fe44ed62b75

SHA512
a52ca0314a6a0b0e0644214a17955b16056fb84700dcca1b67f58d38feea61ffa6e8ef1bbb9446df0746f7fecdd69b94b4f7a6388ea85c749c9fa47bba25706d

Download Submit
memory/920-4-0x00000152CB460000-0x00000152CC460000-memory.dmp

Filesize
16.0MB

Download
memory/920-12-0x00000152CB440000-0x00000152CB441000-memory.dmp

Filesize
4KB

Download