1029b217ffdc43c0f4cec916cceef1ae934f12bb71850b6050d8b3a65bfa5711

Analysis

max time kernel
110s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AMF-KEY-2024.jar
Size 6.9MB
Sample240112-vtlsmschd8
SHA256 1029b217ffdc43c0f4cec916cceef1ae934f12bb71850b6050d8b3a65bfa5711
MD5 e44be98fdc3e442dcb3c6a873478ad78
SHA1 56b2d54e8957131c5c3d273e1ab60bc43d78127b
SHA512 0d20898c26dc8a8c3a2eb8bf079878856a23faefe4249bec518a047d4b567b131b8f741431361190aaca24f7db204218466f0a840bc68e5b548ac0db2a286bf6
SSDEEP 196608:3YXHaAHXv14Y/kfYUsXGRTk8P0qZTr9XFgd3oFLQb:KH14UWs2tvjRiCF2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5116	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 5116	1336	java.exe	89
PID 1336 wrote to memory of 5116	1336	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\AMF-KEY-2024.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 65d0be056191757a9fdbabe7886a1839c9161730d2de8721b190bd55790deb2d
MD5 60e67d0df915c664f85f9f4a93695faf
SHA1 2c33c88d71600fda30e494fa5fa73c6fe7c2f5d2
SHA512 e275b49cb332e96091bce135bb3d838cb69f52df1861ac24ed33c716b73f4057f73516747378abd31b8d91f0ce5a9e166f56dfbd3d4773e3e37e6e9a6bd5fadc
MD5 SHA1 SHA512

Submit Download

memory/1336-4-0x0000026E3FAB0000-0x0000026E40AB0000-memory.dmp

Download

memory/1336-17-0x0000026E3FA90000-0x0000026E3FA91000-memory.dmp

Download

memory/1336-19-0x0000026E3FAB0000-0x0000026E40AB0000-memory.dmp

Download

memory/1336-23-0x0000026E3FD30000-0x0000026E3FD40000-memory.dmp

Download

memory/1336-24-0x0000026E3FD40000-0x0000026E3FD50000-memory.dmp

Download

memory/1336-25-0x0000026E3FAB0000-0x0000026E40AB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads