b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
116s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/libraries/java/PackXZExtract.jar
Size

120KB
MD5

cf8aa6c50804b3d2448b316b1cd24b17
SHA1

a69190724b20156dd17504162fbe771309415b73
SHA256

a847432bdf7da12571bbd5bda3b11ca3664675d1ff9baad5abd59b2d0689fa93
SHA512

d897b843cf6d138885ffbcddcd53c84819bca0a1ac9de46334601d67fa9ba05d6b857b396a67b6f92e9f7745fce3f1a0402b76e4b31bd56d3cd36c339ac1e07c
SSDEEP

3072:4KKXNfoEU3hN7cOGhjVjRGreZHupS4uHAtS8X:bKip377EXGHqHAwG

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1268	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1268	3084	java.exe	90
PID 3084 wrote to memory of 1268	3084	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\PackXZExtract.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3084-2-0x0000013B49750000-0x0000013B4A750000-memory.dmp

Filesize
16.0MB

Download
memory/3084-12-0x0000013B47EE0000-0x0000013B47EE1000-memory.dmp

Filesize
4KB

Download