97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Swift Copy Remitance-pdf.jar
Size

432KB
MD5

8ec9eb589dc78c7e0ad9c8155027a133
SHA1

f4cc5469b945ce8f4c5d266375c28f97636479ff
SHA256

97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9
SHA512

0044e07c000634a043aae2b9f42df7f9f1d0dba2462207663c7f0e9e322cb732b19ab0e7f1fdd653b587c0ce19f5efc93fb7e630ff3477e5e98bcb652f723a1c
SSDEEP

6144:VwhA+Jd+Z+qYYQJXELxEG1E3RjdZO8uk/VSADdEwyOygQc8axuk9:VwC+Jd+Q1hENLE3JdU8fsg5XQc8axf9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5084 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1004 wrote to memory of 5084 1004 java.exe icacls.exe
PID 1004 wrote to memory of 5084 1004 java.exe icacls.exe

pid	process
5084	icacls.exe

description	pid	process	target process
PID 1004 wrote to memory of 5084	1004	java.exe	icacls.exe
PID 1004 wrote to memory of 5084	1004	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Swift Copy Remitance-pdf.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:5084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
ee3524a973edef85a059d81787510dfa

SHA1
baa9f27c7be8a155874c6557290de46c83a35bd9

SHA256
ee4f1970a13693446a53e201e55e597f39c9b439a911bab4fba6ff23fee6f802

SHA512
331c827d9317120b86d6af94cd620388a4769ac21ddc31fa904441bea58b94db0901129c1965b2c62f136b88e17e533910662ced3dbb9b1ebcdf9ddb5450abf5

Download Submit
memory/1004-64-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-158-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-19-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-30-0x000002E302A60000-0x000002E302A61000-memory.dmp

Filesize
4KB

Download
memory/1004-31-0x000002E302A60000-0x000002E302A61000-memory.dmp

Filesize
4KB

Download
memory/1004-32-0x000002E302A60000-0x000002E302A61000-memory.dmp

Filesize
4KB

Download
memory/1004-33-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-84-0x000002E302A60000-0x000002E302A61000-memory.dmp

Filesize
4KB

Download
memory/1004-172-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-12-0x000002E302A60000-0x000002E302A61000-memory.dmp

Filesize
4KB

Download
memory/1004-43-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-151-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-152-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-153-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-155-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-156-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-157-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-4-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-167-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download
memory/1004-56-0x000002E3042A0000-0x000002E3052A0000-memory.dmp

Filesize
16.0MB

Download