147a2f0b5db31df9dd9ed75cf520cf7b434e26e286392dadbbcaff90df219d28

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e2ab591bedbba74f8eec6456ae47d5d.jar
Size 102KB
Sample240128-2c3hdsbee9
SHA256 147a2f0b5db31df9dd9ed75cf520cf7b434e26e286392dadbbcaff90df219d28
MD5 7e2ab591bedbba74f8eec6456ae47d5d
SHA1 5c835fdf5fa55493eb7bc9a711a9cf417ded08ed
SHA512 b13365a04eb72e7aedaf8173a196b5ce4a24d81ba1462ac59fbaf7ec568d97b2760643c0d727a7bb125d6a8ce861786102dbbab9dc89fdcc8411cf7031dd5ca4
SSDEEP 1536:rPApu9LxVwivNyje/xCkj4qzzrv1CVftcO7pChN1mb+n1EKF/FZ7FQo9y:xLHZp1jxzrv1C0Vhyb+n1EWdZ5Vy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3536	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3536	2376	java.exe	88
PID 2376 wrote to memory of 3536	2376	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\7e2ab591bedbba74f8eec6456ae47d5d.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 d53e6ee84b4e1d725fa1d00b3c1fac438ad60db2b26a528cf005f2b3659c99bf
MD5 fb09240478bc814753ea0a624e6837cc
SHA1 c5eceac39a320079c955f0ae4156e19fd79fa495
SHA512 0f3f06e77dc7f71f52a4871c0c6f4c919f6d1c893d1134c3f220848873823c26ebe93fb71d293e1d9a618ddfc86f74063e8c0948ecca4a0739b69130488ac76b
MD5 SHA1 SHA512

Submit Download

memory/2376-4-0x000001FA959C0000-0x000001FA969C0000-memory.dmp

Download

memory/2376-14-0x000001FA941C0000-0x000001FA941C1000-memory.dmp

Download

memory/2376-16-0x000001FA959C0000-0x000001FA969C0000-memory.dmp

Download

memory/2376-18-0x000001FA959C0000-0x000001FA969C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads