15ffe1bf3b3ee92bb5abbaef520a01df45e56a8b6c0dfb77019bece93c6276f3

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a7d021d1ccc36868b4bbabce9e8630b.jar
Size

7KB
MD5

5a7d021d1ccc36868b4bbabce9e8630b
SHA1

6ddecebeccd4b9e8c5d921b8be5e227e0ba42333
SHA256

15ffe1bf3b3ee92bb5abbaef520a01df45e56a8b6c0dfb77019bece93c6276f3
SHA512

48f69a2f864be465eb900a779131869b3b4a7eac2fba47c73237abd8d63652c54c99083fcf587758b1abe1dee82bcd222dc008b3ae1b48a300da288cd50e6d8d
SSDEEP

192:gSlZyNYlG4gD3JjN3Nu0ibwL8lOJVuDrcrlXlIW7lG2Lu:gSlZyNYGDZjN3NJWQ8IS/crtmW7Hu

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3536	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3536	2920	java.exe	91
PID 2920 wrote to memory of 3536	2920	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\5a7d021d1ccc36868b4bbabce9e8630b.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
0fc111d954c28a1c81f06b479fb196cc

SHA1
3a008e6d55792c6be274c897c20973f574d66d39

SHA256
1012c4679566d128c1537b0ae956ba0cbc143be4808a8f2969c478a2b41d07f0

SHA512
b1d233a5f24f8f3dcc885c4543c8a9cd2d3f2d9c0cf1ebcea7a13e6443a203c33497002535d2f7f9ccb076f1c30fad958b1b89e4df677ebcc93798dc79bc0c72

Download Submit
memory/2920-4-0x000002185CEA0000-0x000002185DEA0000-memory.dmp

Filesize
16.0MB

Download
memory/2920-11-0x000002185CE80000-0x000002185CE81000-memory.dmp

Filesize
4KB

Download
memory/2920-13-0x000002185CEA0000-0x000002185DEA0000-memory.dmp

Filesize
16.0MB

Download