f3e0a6e17eeda07acb7520a9dc68018ec070999042895e2e10dea6d60ff1d5b8

Analysis

max time kernel
147s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6c77989399c2f6afc7ae8c7b0246988.jar
Size 1KB
Sample240108-ecg55abfa3
SHA256 f3e0a6e17eeda07acb7520a9dc68018ec070999042895e2e10dea6d60ff1d5b8
MD5 d6c77989399c2f6afc7ae8c7b0246988
SHA1 9cada7fd1d13d04f72293fb56c2c4c599cf0b684
SHA512 0be1589227862eac0d591d7abb7ea644fd1ddadc2bad809c7d97b17a71cca205279839651cc2d6bb96d2002944db7192d0f9c8eba920cce39476fe2473530c4c
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4732	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4732	3404	java.exe	47
PID 3404 wrote to memory of 4732	3404	java.exe	47

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\d6c77989399c2f6afc7ae8c7b0246988.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-4-0x000002126D7B0000-0x000002126E7B0000-memory.dmp

Download

memory/3404-13-0x000002126D790000-0x000002126D791000-memory.dmp