00172976ee3057dd6555734af28759add7daea55047eb6f627e5491701c3ec83

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00172976ee3057dd6555734af28759add7daea55047eb6f627e5491701c3ec83.jar
Size

219KB
MD5

7ac6ab0b4cd03b1cb7da928b324cb933
SHA1

71b0d8b34ceed49dc0a4f3a42dba42391475f302
SHA256

00172976ee3057dd6555734af28759add7daea55047eb6f627e5491701c3ec83
SHA512

b1c81159713d95312c0cfd46c67dd348714a45ec454f3e7752cce309eb2b089e6692400e40eb55cb080c671e7ab5f8ad20127b2b839966ab8f657a8d12effe94
SSDEEP

3072:SNTGUI+R4oVOQa7khVBUfC4OCnHvT1Yga8ZQH/MHVJy7knuuCceanPRMILYmfVIV:SgUJ4oi7PfNnPZYZMPy9AP2IEmfCHMtc

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1184	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 1184	3880	java.exe	84
PID 3880 wrote to memory of 1184	3880	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\00172976ee3057dd6555734af28759add7daea55047eb6f627e5491701c3ec83.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b58786225d7e1c82cae7c8246c79993b

SHA1
6d6b866a48b84f27b05a814446116396485f2682

SHA256
d2520f6c00db266d282952d909e57040070bf2db6ba4e266096b5f1a348ff0b4

SHA512
2815e4a6d42fb1233bd2b853be9d7d04d8e913f98bf0ac3347792e4a1c898db03ead40a9678e8bae6ced4766c9ae30246142986a1c6de619f039f99124dec291

Download Submit
memory/3880-33-0x000002300EC80000-0x000002300EC90000-memory.dmp

Filesize
64KB

Download
memory/3880-14-0x000002300D1C0000-0x000002300D1C1000-memory.dmp

Filesize
4KB

Download
memory/3880-16-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download
memory/3880-27-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download
memory/3880-32-0x000002300EC10000-0x000002300EC20000-memory.dmp

Filesize
64KB

Download
memory/3880-4-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download
memory/3880-34-0x000002300EC40000-0x000002300EC50000-memory.dmp

Filesize
64KB

Download
memory/3880-37-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download
memory/3880-38-0x000002300EC70000-0x000002300EC80000-memory.dmp

Filesize
64KB

Download
memory/3880-36-0x000002300EC60000-0x000002300EC70000-memory.dmp

Filesize
64KB

Download
memory/3880-35-0x000002300EC50000-0x000002300EC60000-memory.dmp

Filesize
64KB

Download
memory/3880-39-0x000002300EC90000-0x000002300ECA0000-memory.dmp

Filesize
64KB

Download
memory/3880-40-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download
memory/3880-41-0x000002300E990000-0x000002300F990000-memory.dmp

Filesize
16.0MB

Download