d0c5b5a12071559d9c8e6a8cb47649e3f8da84a510ee8a3d485409544f2bfdfd

Analysis

max time kernel
26s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

create-1.18.2-0.5.1.f.jar
Size

14.2MB
MD5

a9fc645f2a4720f831794bd160b9bc0b
SHA1

0acb9c11d4a72f6e9b1e520628b282788e6fd0bb
SHA256

d0c5b5a12071559d9c8e6a8cb47649e3f8da84a510ee8a3d485409544f2bfdfd
SHA512

d2b8baa716f8804bb4c8258fd3dd2e537f106f0520e28165fbbee1fb321b6fd2716ccc25877f1e8ab9cb784e01226ab09ce630afff45eba991e69e07ce516bf6
SSDEEP

196608:OhXfm/G1D3nJsX45E7vNXdYhlYANLVvC80P3o7JFHTEcbTghlYfPVCaFSA+jaGPX:emizj5iv/qld3EfuPTEDqPC5POVg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3288	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3288	4836	java.exe	90
PID 4836 wrote to memory of 3288	4836	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\create-1.18.2-0.5.1.f.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
cf38d5a00103f293bc06f83aaa07d694

SHA1
d11daab2a4f6a9afd0c0153ed8773c5a7365f52c

SHA256
8da89997cbf63698eca21b15c1a38c4b8e49833495575fe0ddcc69df8f7b3e8d

SHA512
b3093fd99e3d5438eae7d35994e4417f1168b0c868783b22f9d1c72ed8258b65c8c3d94e8f6153a9773a9a4c54c681955789f914438885a1e0ecd3fd0b01a163

Download Submit
memory/4836-4-0x0000026C00000000-0x0000026C01000000-memory.dmp

Filesize
16.0MB

Download
memory/4836-11-0x0000026C7A540000-0x0000026C7A541000-memory.dmp

Filesize
4KB

Download
memory/4836-13-0x0000026C00000000-0x0000026C01000000-memory.dmp

Filesize
16.0MB

Download