b8854611b04b7ff0269ba30bc535bc4ec583e639a4385818d80ef6ae9c16fb9d

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c176289fce610d62f725d77e3a7d01.jar
Size

99KB
MD5

41c176289fce610d62f725d77e3a7d01
SHA1

1dae1e614e39617736f087af8974eaccabbec6f2
SHA256

b8854611b04b7ff0269ba30bc535bc4ec583e639a4385818d80ef6ae9c16fb9d
SHA512

6fe3dc69a6f535ab70585e3c24a96f49971cf490be03263076e566d0f3c38f1388790d8b0db02f45ba65dde36c34147722ca374c813cba9dc4d372c4c4755948
SSDEEP

1536:ayNjdW+3p0L6R62S0Wn7xwxMwM7Xpg1XEWW0o37BwAQ/LjA7d9TMMuDTMoT6N:ayK+Z0SyRnlwKRy10z7O1A7ddMMu7TS

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3200 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2984 wrote to memory of 3200 2984 java.exe icacls.exe
PID 2984 wrote to memory of 3200 2984 java.exe icacls.exe

pid	process
3200	icacls.exe

description	pid	process	target process
PID 2984 wrote to memory of 3200	2984	java.exe	icacls.exe
PID 2984 wrote to memory of 3200	2984	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\41c176289fce610d62f725d77e3a7d01.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
fc2b1e1b53b0ec7a7d696180ef47b893

SHA1
768b1d0ca6b7fb4c53fee2460c9b8591d112c0cc

SHA256
250e8cf2048257816c06e92e51c1e2ee88be30335d9548ddc7dcc4f6f226ad38

SHA512
59f78fde2e38ff69b75360bec03d954a7a773d73ee764a7fd8219bdf48f7982ac40d3637f7d803a32f4748b960e4433cb8bd850884d53bbc5d307f534e3c1af7

Download Submit
memory/2984-35-0x00000247C7E80000-0x00000247C7E81000-memory.dmp

Filesize
4KB

Download
memory/2984-16-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-18-0x00000247C7E80000-0x00000247C7E81000-memory.dmp

Filesize
4KB

Download
memory/2984-24-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-36-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-4-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-41-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-48-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-50-0x00000247C7E80000-0x00000247C7E81000-memory.dmp

Filesize
4KB

Download
memory/2984-57-0x00000247C7E80000-0x00000247C7E81000-memory.dmp

Filesize
4KB

Download
memory/2984-81-0x00000247C7E80000-0x00000247C7E81000-memory.dmp

Filesize
4KB

Download
memory/2984-140-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-143-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download
memory/2984-147-0x00000247C9650000-0x00000247CA650000-memory.dmp

Filesize
16.0MB

Download