945fddfc1fa07995d86ba94d167693ce80f462b3738a6c1c05a5557601aadf2f

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c967e80d69f6d0407af817acc034ee9.jar
Size

110KB
MD5

8c967e80d69f6d0407af817acc034ee9
SHA1

2dab6fb260d020c40b92280effb4c6f91a97b0ed
SHA256

945fddfc1fa07995d86ba94d167693ce80f462b3738a6c1c05a5557601aadf2f
SHA512

63a9f6fd6ec35bb67eebda6a4f1cbb75a2a4d76a800afbac9b04aa2b65a767aab917fd1ba9bfac96386949b7103f96f9b4b66b7eceb2c09f2506d1b465552e15
SSDEEP

1536:m+6lO77EyNyGSZTvdBxX5CJgOn1HAqnA/GSHLx4hVtjZZ30mlz9YfijW/lS6:mFyYJxX5eggArOSrehHZZEmlx9C/D

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3940 icacls.exe

pid	process
3940	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3364 wrote to memory of 3940 3364 java.exe icacls.exe
PID 3364 wrote to memory of 3940 3364 java.exe icacls.exe

description	pid	process	target process
PID 3364 wrote to memory of 3940	3364	java.exe	icacls.exe
PID 3364 wrote to memory of 3940	3364	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\8c967e80d69f6d0407af817acc034ee9.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
c96dcf1835e94417362960785912113a

SHA1
31f4b35aacfc32e077c8f0fd758437161feb9c77

SHA256
4729570392d2cb75053be0c2788d6db08cde2886b1d50a1047995e4e41adea79

SHA512
9f70d43d833bdc0b765d50ad815d74eff88e455304aa84d9ac3ea5c526e4026ccd727ca18b0675bd4650583ebacff1b2a7059164cfe8c57872ce8f02a1594d5e

Download Submit
memory/3364-45-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-51-0x0000026B59D70000-0x0000026B59D80000-memory.dmp

Filesize
64KB

Download
memory/3364-20-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-33-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-35-0x0000026B59A10000-0x0000026B59A11000-memory.dmp

Filesize
4KB

Download
memory/3364-41-0x0000026B59CB0000-0x0000026B59CC0000-memory.dmp

Filesize
64KB

Download
memory/3364-43-0x0000026B59CE0000-0x0000026B59CF0000-memory.dmp

Filesize
64KB

Download
memory/3364-46-0x0000026B59D00000-0x0000026B59D10000-memory.dmp

Filesize
64KB

Download
memory/3364-55-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-12-0x0000026B59A10000-0x0000026B59A11000-memory.dmp

Filesize
4KB

Download
memory/3364-42-0x0000026B59D20000-0x0000026B59D30000-memory.dmp

Filesize
64KB

Download
memory/3364-47-0x0000026B59D10000-0x0000026B59D20000-memory.dmp

Filesize
64KB

Download
memory/3364-48-0x0000026B59D30000-0x0000026B59D40000-memory.dmp

Filesize
64KB

Download
memory/3364-49-0x0000026B59D50000-0x0000026B59D60000-memory.dmp

Filesize
64KB

Download
memory/3364-50-0x0000026B59D60000-0x0000026B59D70000-memory.dmp

Filesize
64KB

Download
memory/3364-52-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-53-0x0000026B59D80000-0x0000026B59D90000-memory.dmp

Filesize
64KB

Download
memory/3364-4-0x0000026B59A30000-0x0000026B5AA30000-memory.dmp

Filesize
16.0MB

Download
memory/3364-54-0x0000026B59D90000-0x0000026B59DA0000-memory.dmp

Filesize
64KB

Download
memory/3364-44-0x0000026B59CF0000-0x0000026B59D00000-memory.dmp

Filesize
64KB

Download