cc5238fbf83ee7cbbea0e0f13d23cbda1ff5eb9986d79a6e9597adfd19df68c0

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20c084b0e6afbc9f0cc8b13d7e36bbe4.jar
Size

3KB
MD5

20c084b0e6afbc9f0cc8b13d7e36bbe4
SHA1

01be84b4f08c5125386ec61bfcab552187cdd9a7
SHA256

cc5238fbf83ee7cbbea0e0f13d23cbda1ff5eb9986d79a6e9597adfd19df68c0
SHA512

ee3f735ab9726e987db577080e0eda5e3f9531fe867e179540b2acdc891962cdcfe5ccc9a3f50aab35f866ddc08ecf9c45a534a0e68c66b486bbb51a9698d553

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1708	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 1708	2512	java.exe	90
PID 2512 wrote to memory of 1708	2512	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\20c084b0e6afbc9f0cc8b13d7e36bbe4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
cd94d9794fc9ad282af8c3d40aac5ab6

SHA1
52fe91783860e002185e9488453ad203dc6c8f99

SHA256
41f066f4f8e2a16ecd598fedc67877646dd864c6da3519399aa8cc3eb3d719aa

SHA512
cfb93952dcd1a724218325689cd4bc2a9870b06ce086bbcbb96454119c14d93dc20f4a9346be13fbf88cdd59fd3570603e0b4b379dfe6961f1e87fc4810a8864

Download Submit
memory/2512-4-0x000001DC0F630000-0x000001DC10630000-memory.dmp

Filesize
16.0MB

Download
memory/2512-12-0x000001DC0DDE0000-0x000001DC0DDE1000-memory.dmp

Filesize
4KB

Download