Analysis
- max time kernel
147s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/01/2024, 14:02
General
- Target 410e1d09f6a289fa71a8eed48c507e48.jar
- Size 99KB
- Sample240104-rcfcraccb4
- SHA256 060d4851769b37c553543f98955c98c4c6a0dd2faecafb7d87b61d201ce13698
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\410e1d09f6a289fa71a8eed48c507e48.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/5064-67-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-78-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-19-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-4-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-36-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-48-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-52-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-53-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-12-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-59-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-28-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-107-0x0000023B9FA40000-0x0000023B9FA41000-memory.dmp
memory/5064-129-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-147-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-152-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-156-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-160-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-168-0x0000023BA1300000-0x0000023BA2300000-memory.dmp
memory/5064-175-0x0000023BA1300000-0x0000023BA2300000-memory.dmp