1ec0a2a6f9f318919a5e3e811c39632cbfd130d7ce6d4001a02d645e8366ecd9

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

jlayer.jar
Size

102KB
MD5

7b672b4badc89286055adcc810f47df8
SHA1

33c346fe3c5f75dfbfb477e1f3d8446427633890
SHA256

eabaa070e57a204d441cd9b20200f74c165c4dd9cfb9dbf37eeabb3b713c6fac
SHA512

68b8c7aa6093ab706447ea334e47e7bceae06c05b787eaeb9f29f53c906d6dacf53d4ae17b330c6d0eaf6d54ad9eaf5b1e79ef3ddd54b9ccaa7c093b78dd214c
SSDEEP

3072:42eYS3dK2djpLdl00XnhcaCsbjaOWSRWHKKuISci+D+:4V3drtrHqgRhfIS+S

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2072	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 2072	1036	java.exe	92
PID 1036 wrote to memory of 2072	1036	java.exe	92

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jlayer.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c753919af7a17dd0deef225c22c34645

SHA1
0d49b41219583fe63489ed220b64532cee35595f

SHA256
f303980433ae61a1c55870c71ed9f3c15fa7799374331a5b9d531c20b01c3b29

SHA512
9e1680fdb7fc91537d0db0bc9aab4e8beb03df632a99ad0d86f2dd82de74478d7c04beb56ea46bbc743e633990502093b99eec6a12d10d621bd82b7533759411

Download Submit
memory/1036-4-0x000001583B9E0000-0x000001583C9E0000-memory.dmp

Filesize
16.0MB

Download
memory/1036-11-0x000001583A1A0000-0x000001583A1A1000-memory.dmp

Filesize
4KB

Download