Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 13:16
Behavioral task
behavioral1
Sample
SalykFormJavaRU.jar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SalykFormJavaRU.jar
Resource
win10v2004-20231215-en
General
-
Target
SalykFormJavaRU.jar
-
Size
219KB
-
MD5
14c6e272eb3038aa41a57f5c81fd9fb3
-
SHA1
31ed947d4295f8ffdad8a1af78d08fb431919fc4
-
SHA256
ee113a592431014f44547b144934a470a1f7ab4abec70ba1052a4feb3d15d5c6
-
SHA512
651f36f008fb0be1117fb9cd81ce184e97032445c1fda759edb80837ece1a73c3872b5ab11db7f2fda8f8eb94b461678d8e3e2b7d771e8a30257f9565ed081e5
-
SSDEEP
3072:puOsIqeGoQp3ep/Ae/me0CRXfAG3n1DiONTQZr0r78G+2/dpM/r1SioJuU2hTaXd:cURGoieee0CSyn1dNEyrk2LM/r1joI4t
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 2912 wrote to memory of 532 2912 java.exe icacls.exe PID 2912 wrote to memory of 532 2912 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\SalykFormJavaRU.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5d8da3d35e5a23419139d7c66cc7dc166
SHA185f3aebd57ab4e40c0eda99e9f9e003f0484fff7
SHA256df4f6b62f7c595f21580624666bb04021c18523f7fd3687794c7914ccca4b378
SHA51248c4f93b6b8eb8f65f9960c3d971d1fdee540db6cf753caaba031210cabf4153fabc744779cc0b6509dc884dcebcc74fb4a09dfbb7aee8e3ce0a065d3937eb33
-
memory/2912-31-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-12-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-18-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-19-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-29-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-4-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-48-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-52-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-59-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-67-0x000001275E6D0000-0x000001275F6D0000-memory.dmpFilesize
16.0MB
-
memory/2912-69-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-79-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB
-
memory/2912-83-0x000001275CEA0000-0x000001275CEA1000-memory.dmpFilesize
4KB