e91d0d0170c7682404fb2a6c156789cf2c6cb7a3f98369b22f0b461ec5fa84f4

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc20210812876462_PDF.jar
Size

94KB
MD5

9f431f7105d073752fd396105dc898ef
SHA1

62058bd9d3683d7a6983d36722fede080b87c3d3
SHA256

32cbcd636b3295b79872dc883f84bd3c5f378f9e2bd64a73148e8a3d5d6d58f9
SHA512

26df1f20d773c009df88e440a484dd5feafc8f3ef46ddf90fcd465eb1c4b44bff112a44c2f79b9168aa64564bfd7a48ec14d110384e3d5d3944b9ada1460aee0
SSDEEP

1536:Ex4jk2LwtGGBCRLwZ0MQ6i98iZGmAT5hSXx93uf3gdTsypX7GufP16wzInBvOwv:VjLwtGLi0MQ6iS8ATo9efwfplP11zC

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

388 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3768 wrote to memory of 388 3768 java.exe icacls.exe
PID 3768 wrote to memory of 388 3768 java.exe icacls.exe

pid	process
388	icacls.exe

description	pid	process	target process
PID 3768 wrote to memory of 388	3768	java.exe	icacls.exe
PID 3768 wrote to memory of 388	3768	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\doc20210812876462_PDF.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3768

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
9ba87a3eca48f5d3b6e979181b4b0a6d

SHA1
bacc6fb15f2b7df30674cc35ede5b529f254368a

SHA256
cd568556859956b1bfe10e48c2d5e47de41bf18d5fe76c62edf40f1d9c4b38e9

SHA512
9b542cc978a69faa6e4d438ac6228f1adb5c8c24f1d0d41b88c31ff910b68e9a50628512cf0af84e84ba46a7a15c00b55c045c9ccbb25a8ef51534661b0d8108

Download Submit
memory/3768-4-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-18-0x0000025C84780000-0x0000025C84781000-memory.dmp

Filesize
4KB

Download
memory/3768-19-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-29-0x0000025C84780000-0x0000025C84781000-memory.dmp

Filesize
4KB

Download
memory/3768-33-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-48-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-52-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-57-0x0000025C847A0000-0x0000025C857A0000-memory.dmp

Filesize
16.0MB

Download
memory/3768-72-0x0000025C84780000-0x0000025C84781000-memory.dmp

Filesize
4KB

Download
memory/3768-76-0x0000025C84780000-0x0000025C84781000-memory.dmp

Filesize
4KB

Download
memory/3768-78-0x0000025C84780000-0x0000025C84781000-memory.dmp

Filesize
4KB

Download