Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-01-2024 20:22

General

  • Target

    4719369301021c7fafd27809940a39e2.jar

  • Size

    107KB

  • MD5

    4719369301021c7fafd27809940a39e2

  • SHA1

    3ba8f49bfa4012a9c6a8037c1578591014fbbb99

  • SHA256

    0a4662f9f759781f50cecb082c783d73cf78b388ee0904fd11286417879286e2

  • SHA512

    bfa0921afcdb27a810466d68c9668cc0c7202a1e36a7bccf40cf3fd373ca2ee4043eb1f17a167fafab9a34b9af5170a62dc169478bce055373b9d001c8c9a9f8

  • SSDEEP

    3072:O4tT+jKYgGT+0rREjSgM+Kgr9CCjQ3SWPA:OEyjKY5ngM+Kgr0+T

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\4719369301021c7fafd27809940a39e2.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    9ef0609a4942de46975f999e1708ba71

    SHA1

    e6700789f1617d1de8579799dd43da02f91eaa04

    SHA256

    bd89b9809adf8b33e143bad65820e0adf9586c7b18c6c0ca807c563b53414424

    SHA512

    76db51ef6186e60fa044877e5baae8bf2428295fe01945a2cd6e7d93ca769a0df060039cfaac1fbea797011d86803657402fd34c38b54022964f84ef6bef35e9

  • memory/1356-139-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-186-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-19-0x00000216FACD0000-0x00000216FACD1000-memory.dmp

    Filesize

    4KB

  • memory/1356-28-0x00000216FACD0000-0x00000216FACD1000-memory.dmp

    Filesize

    4KB

  • memory/1356-29-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-39-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-45-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-50-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-56-0x00000216FACD0000-0x00000216FACD1000-memory.dmp

    Filesize

    4KB

  • memory/1356-136-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-189-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-17-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-142-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-141-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-140-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-150-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-155-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-157-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-161-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-176-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-185-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-4-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-187-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB

  • memory/1356-137-0x0000021680000000-0x0000021681000000-memory.dmp

    Filesize

    16.0MB