Analysis

  • max time kernel
    156s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 15:50

General

  • Target

    3a635340d63f75e27e2c195dd9f0506d.jar

  • Size

    101KB

  • MD5

    3a635340d63f75e27e2c195dd9f0506d

  • SHA1

    c85533e94cfafaa1fe7e0cc42032170b6df6ab0b

  • SHA256

    433af927acfbda8332ff1acba40e8a658fbdfe09bfafda8d010a43a3bba534eb

  • SHA512

    c9b646c3574deb745096632c0ce76b5ccf092ff625e1deba38f1ef2e89ec7969f5439872cd4f845b09190965689bab0e149526cc6eebcc59151555c9f0fe0823

  • SSDEEP

    1536:aCDBRTixq1EbW+rwd+bH1tZ24NJ3bqoaGV5trERIgSDPgAUmJ5us50X94MplyGRb:pHSb9Ud+xtZdW6V5VNUm50XSCl3/Wg

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\3a635340d63f75e27e2c195dd9f0506d.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    0af80541ba34bb35b6f1c4fb69eb08ce

    SHA1

    a0081512af57f850390b4003e3309c28ca0dd1a1

    SHA256

    cd9aacf877c689a43e3e99090e7af85ba3616d28cb4abb581d942a088de40f10

    SHA512

    2649667a3a661b5e634827de3c78e6e6ed6b880a8f7f616fcdcc7ae290c68c9bafc128bf544c75c618c42a65efcffdff20427fb3ca31161cbe08f385af85fbd0

  • memory/4724-61-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-161-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-58-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-29-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-35-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-44-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-49-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-52-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-54-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-64-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-19-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-12-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-57-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-82-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-94-0x000001C5BF4E0000-0x000001C5BF4E1000-memory.dmp

    Filesize

    4KB

  • memory/4724-113-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-118-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-136-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-137-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-139-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-149-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-153-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB

  • memory/4724-4-0x000001C5C0CD0000-0x000001C5C1CD0000-memory.dmp

    Filesize

    16.0MB