531dfa57bbf0708bcf58662dfe618d8f829a80eda0aec960a325480d1e0b7605

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spy Note 6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Size

3KB
MD5

d9c23d7574c0d886321dcd029e463f2c
SHA1

7fad47eb6860a01325c6d526a43d9bbadb66aff7
SHA256

e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed
SHA512

c32c019fb0bacbd70441cf3ed769bfde9597389f840ff8511db36586756382ef22bd163a7b7cb9e258a4b7a896e5d1a606d92513a141cb2e3c6e421a66ecb316

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1100 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3596 wrote to memory of 1100 3596 java.exe icacls.exe
PID 3596 wrote to memory of 1100 3596 java.exe icacls.exe

pid	process
1100	icacls.exe

description	pid	process	target process
PID 3596 wrote to memory of 1100	3596	java.exe	icacls.exe
PID 3596 wrote to memory of 1100	3596	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Spy Note 6.4\Resources\Imports\PlayerJava\PlayerJava.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
74c9937adfb908aae72bea2eb2d3f433

SHA1
713ec815122f55bd4574bbe987002e3c11a86cc2

SHA256
de90ab767e99972fbc01c4f6ceb25f940ba2c7b3a18fc0592ffc82f302b9047b

SHA512
0a77e5c1620ed8ac51e66a97ea2dd86d5a1d065b7b1ff2e2c4c6f696ad5f37f2d987823350067fdcc95ebf9ce750d94f054ed34c6f3335521b03246c7e043e26

Download Submit
memory/3596-4-0x000001C3BE590000-0x000001C3BF590000-memory.dmp

Filesize
16.0MB

Download
memory/3596-13-0x000001C3BCD00000-0x000001C3BCD01000-memory.dmp

Filesize
4KB

Download