2cf13d26347da2c0d0e134bc200d361bdb3156e68734e82f21688cb6860b1798

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 15:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spy Note 6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Size

3KB
MD5

d9c23d7574c0d886321dcd029e463f2c
SHA1

7fad47eb6860a01325c6d526a43d9bbadb66aff7
SHA256

e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed
SHA512

c32c019fb0bacbd70441cf3ed769bfde9597389f840ff8511db36586756382ef22bd163a7b7cb9e258a4b7a896e5d1a606d92513a141cb2e3c6e421a66ecb316

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4276 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4920 wrote to memory of 4276 4920 java.exe icacls.exe
PID 4920 wrote to memory of 4276 4920 java.exe icacls.exe

pid	process
4276	icacls.exe

description	pid	process	target process
PID 4920 wrote to memory of 4276	4920	java.exe	icacls.exe
PID 4920 wrote to memory of 4276	4920	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Spy Note 6.4\Resources\Imports\PlayerJava\PlayerJava.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
425bee3211d1c4a98504040aaf81005f

SHA1
c7e88a9fd905b060a01ce85efd1597cd198ad880

SHA256
7251f07cc7556ce487cd0c1bb169343f878c600460cc3537ebbb320452ed2fa2

SHA512
c9ec6474c7be27205aeae8e66a7a6f7312b30f6e18743d31649888598bd7e54e9bce8e8f986b06dbeff3abf86dcef0d688d3d7ab801e8913bec36fa92b38320c

Download Submit
memory/4920-4-0x000002D1E5A30000-0x000002D1E6A30000-memory.dmp

Filesize
16.0MB

Download
memory/4920-13-0x000002D1E4200000-0x000002D1E4201000-memory.dmp

Filesize
4KB

Download