8ac04875976ff5f2b443dde670ba53f812e7ffff42e72336482081bacb337f38

Resubmissions

29/12/2023, 08:01

231229-jw3ndsgah2 7

29/12/2023, 07:56

231229-jsp8wscgfm 7

Analysis

max time kernel
485s
max time network
621s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

_874D1567799B7B9AFBEE570F7726949B.jar
Size

542KB
MD5

bd130f4d29db271be2f06865e06fbf05
SHA1

9b2d7530512307c33437745b3fed9862ef887ddf
SHA256

6708cbd5003ebabc78c07db370a31e48a37dd84c854df70c97d658c41c20c50a
SHA512

7b145b7a0320b8e09108301b3e5ec99035ef309222da30574025de455ddbd9be2311a193bf889b72d167ffe4ff17ecb316df962574dd1bd6399d67fceecf22d8
SSDEEP

12288:6WYfvZKpvMHb9+ALF3TEYcqAprfFPzZY4jgiovcfUR:6J0h+F3gY1srfjXovcQ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5072	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 5072	4448	java.exe	101
PID 4448 wrote to memory of 5072	4448	java.exe	101

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\_874D1567799B7B9AFBEE570F7726949B.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4448-2-0x000001FCB22E0000-0x000001FCB32E0000-memory.dmp

Filesize
16.0MB

Download
memory/4448-5-0x000001FCB22E0000-0x000001FCB32E0000-memory.dmp

Filesize
16.0MB

Download
memory/4448-12-0x000001FCB0A70000-0x000001FCB0A71000-memory.dmp

Filesize
4KB

Download