e093519ffea585f56b485b0278d67368a4c0a705c098b622bb91fe127c25cb58

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78b6dca5e8d353aebf6f87328cb9c58c.jar
Size

106KB
MD5

78b6dca5e8d353aebf6f87328cb9c58c
SHA1

2b2cff5ee5c5285c7e62061663976f84537713f5
SHA256

e093519ffea585f56b485b0278d67368a4c0a705c098b622bb91fe127c25cb58
SHA512

2702af06c744afd31832b14397a237b1e86a4e830136fb98431d85fb12026f9bc3e9cb37d17fd29bdf17350d254186a5daba2b2eb21da2ff46cf67cc84f7a37e
SSDEEP

3072:M+3P/hn44wHg1lk4bsQMEsvHCYAjiLV6N8f:MO47g3k4bLsvHFAjiLV6NU

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2388 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3940 wrote to memory of 2388 3940 java.exe icacls.exe
PID 3940 wrote to memory of 2388 3940 java.exe icacls.exe

pid	process
2388	icacls.exe

description	pid	process	target process
PID 3940 wrote to memory of 2388	3940	java.exe	icacls.exe
PID 3940 wrote to memory of 2388	3940	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\78b6dca5e8d353aebf6f87328cb9c58c.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
a0f47d45ac8e5def139a7fa8b9623df6

SHA1
f6a7eda7ec8ad19e79f2a208039e24750bb194c2

SHA256
f1475086167f560b6d404327f5d1467132054bb4b2bb4118fbd6138389f11c37

SHA512
e121fe8bb181fbc16b2fecb94928b3f3f7266867d27bbb884655375fa3f04648e37d3f80dbc39d28070edd0b3defbdf65edf0732f4928574ae8e7bbc21430cae

Download Submit
memory/3940-36-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-12-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-22-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-26-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-33-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-2-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-44-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-48-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-53-0x0000015E90390000-0x0000015E91390000-memory.dmp

Filesize
16.0MB

Download
memory/3940-66-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-73-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-108-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download
memory/3940-109-0x0000015E8EBC0000-0x0000015E8EBC1000-memory.dmp

Filesize
4KB

Download