Analysis
-
max time kernel
21s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
02-01-2024_Dosya.jar
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
02-01-2024_Dosya.jar
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
02-01-2024_Dosya.jar
-
Size
128KB
-
MD5
a164eec975f5cceb02bb9125d78a905d
-
SHA1
d6d48d26a52718cb21871fb6182be223c5ada3e3
-
SHA256
60ae7d873b841b49cf5a7ac0d679428faab3a695148c62428f430f24f1e1f7c3
-
SHA512
7f5753a0d156380cb637985e33851dda449991d8ffa09c23b7066ebfa612d225cc434f3d17fc9a2f6acf6ecb89a2b1ffd45933c5af5f399d8400933cc92f2703
-
SSDEEP
1536:J0yzl1hB6YcSfp6MjMFH6H3agEkuS6DMvNDbvQrOXpwGA+HhSuh7Tv3u/pSJgG6h:RHH6YbAFHUagUDeNDPwR+/v38Yv6gBSP
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4328 icacls.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3292 wmic.exe Token: SeSecurityPrivilege 3292 wmic.exe Token: SeTakeOwnershipPrivilege 3292 wmic.exe Token: SeLoadDriverPrivilege 3292 wmic.exe Token: SeSystemProfilePrivilege 3292 wmic.exe Token: SeSystemtimePrivilege 3292 wmic.exe Token: SeProfSingleProcessPrivilege 3292 wmic.exe Token: SeIncBasePriorityPrivilege 3292 wmic.exe Token: SeCreatePagefilePrivilege 3292 wmic.exe Token: SeBackupPrivilege 3292 wmic.exe Token: SeRestorePrivilege 3292 wmic.exe Token: SeShutdownPrivilege 3292 wmic.exe Token: SeDebugPrivilege 3292 wmic.exe Token: SeSystemEnvironmentPrivilege 3292 wmic.exe Token: SeRemoteShutdownPrivilege 3292 wmic.exe Token: SeUndockPrivilege 3292 wmic.exe Token: SeManageVolumePrivilege 3292 wmic.exe Token: 33 3292 wmic.exe Token: 34 3292 wmic.exe Token: 35 3292 wmic.exe Token: 36 3292 wmic.exe Token: SeIncreaseQuotaPrivilege 3292 wmic.exe Token: SeSecurityPrivilege 3292 wmic.exe Token: SeTakeOwnershipPrivilege 3292 wmic.exe Token: SeLoadDriverPrivilege 3292 wmic.exe Token: SeSystemProfilePrivilege 3292 wmic.exe Token: SeSystemtimePrivilege 3292 wmic.exe Token: SeProfSingleProcessPrivilege 3292 wmic.exe Token: SeIncBasePriorityPrivilege 3292 wmic.exe Token: SeCreatePagefilePrivilege 3292 wmic.exe Token: SeBackupPrivilege 3292 wmic.exe Token: SeRestorePrivilege 3292 wmic.exe Token: SeShutdownPrivilege 3292 wmic.exe Token: SeDebugPrivilege 3292 wmic.exe Token: SeSystemEnvironmentPrivilege 3292 wmic.exe Token: SeRemoteShutdownPrivilege 3292 wmic.exe Token: SeUndockPrivilege 3292 wmic.exe Token: SeManageVolumePrivilege 3292 wmic.exe Token: 33 3292 wmic.exe Token: 34 3292 wmic.exe Token: 35 3292 wmic.exe Token: 36 3292 wmic.exe Token: SeIncreaseQuotaPrivilege 1516 wmic.exe Token: SeSecurityPrivilege 1516 wmic.exe Token: SeTakeOwnershipPrivilege 1516 wmic.exe Token: SeLoadDriverPrivilege 1516 wmic.exe Token: SeSystemProfilePrivilege 1516 wmic.exe Token: SeSystemtimePrivilege 1516 wmic.exe Token: SeProfSingleProcessPrivilege 1516 wmic.exe Token: SeIncBasePriorityPrivilege 1516 wmic.exe Token: SeCreatePagefilePrivilege 1516 wmic.exe Token: SeBackupPrivilege 1516 wmic.exe Token: SeRestorePrivilege 1516 wmic.exe Token: SeShutdownPrivilege 1516 wmic.exe Token: SeDebugPrivilege 1516 wmic.exe Token: SeSystemEnvironmentPrivilege 1516 wmic.exe Token: SeRemoteShutdownPrivilege 1516 wmic.exe Token: SeUndockPrivilege 1516 wmic.exe Token: SeManageVolumePrivilege 1516 wmic.exe Token: 33 1516 wmic.exe Token: 34 1516 wmic.exe Token: 35 1516 wmic.exe Token: 36 1516 wmic.exe Token: SeIncreaseQuotaPrivilege 1516 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3812 java.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3812 wrote to memory of 4328 3812 java.exe 92 PID 3812 wrote to memory of 4328 3812 java.exe 92 PID 3812 wrote to memory of 3292 3812 java.exe 100 PID 3812 wrote to memory of 3292 3812 java.exe 100 PID 3812 wrote to memory of 1516 3812 java.exe 106 PID 3812 wrote to memory of 1516 3812 java.exe 106 PID 3812 wrote to memory of 1792 3812 java.exe 105 PID 3812 wrote to memory of 1792 3812 java.exe 105 PID 3812 wrote to memory of 656 3812 java.exe 104 PID 3812 wrote to memory of 656 3812 java.exe 104
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\02-01-2024_Dosya.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4328
-
-
C:\Windows\System32\Wbem\wmic.exewmic CPU get ProcessorId2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵PID:656
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get name2⤵PID:1792
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD57e4e6c418b66945b788fb1237a18920b
SHA12fc99409e3b228758d4c43ef3d2560676728a145
SHA256cbc40ef21938a33881135c7af016ac043dc7a00b09d24e65e2de07e31b171aa1
SHA512a23c57118c18b90e368d8ef248c050e28284201b6f92cf4503cddad4e12cdcf1845a9daa7c231e09f54788de7e5d64191a4057b84dda1c747ece58a4009a74f4