9cddfb88686bd1668d9d0bac67f2916b77a42d1b3dba14a9eecc576bba17b86a

General

Target

Swift Copy Remitance-pdf.jar
Size

432KB
MD5

8ec9eb589dc78c7e0ad9c8155027a133
SHA1

f4cc5469b945ce8f4c5d266375c28f97636479ff
SHA256

97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9
SHA512

0044e07c000634a043aae2b9f42df7f9f1d0dba2462207663c7f0e9e322cb732b19ab0e7f1fdd653b587c0ce19f5efc93fb7e630ff3477e5e98bcb652f723a1c
SSDEEP

6144:VwhA+Jd+Z+qYYQJXELxEG1E3RjdZO8uk/VSADdEwyOygQc8axuk9:VwC+Jd+Q1hENLE3JdU8fsg5XQc8axf9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1876 icacls.exe

pid	process
1876	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4820 powershell.exe
4820 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exesvchost.exe

description pid process

Token: SeDebugPrivilege 4820 powershell.exe
Token: SeManageVolumePrivilege 4364 svchost.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4172 wrote to memory of 1876 4172 java.exe icacls.exe
PID 4172 wrote to memory of 1876 4172 java.exe icacls.exe

pid	process
4820	powershell.exe
4820	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeManageVolumePrivilege	4364	svchost.exe

description	pid	process	target process
PID 4172 wrote to memory of 1876	4172	java.exe	icacls.exe
PID 4172 wrote to memory of 1876	4172	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Swift Copy Remitance-pdf.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
87009881ef56cdb2465fbc0e8688ed0f

SHA1
c67e6947baf1b2807df2b1832b692930489702cf

SHA256
38a9c0c0d5fb1b9b27f29d0df97958275f65045c43d600c53e977d1f86d87082

SHA512
a6710b182af6529cd80d0c2a00691c0f5af8b7df0199e75fac8719d661408703040cbdd4657bec57dfac0573be133ef80de576de0d53eb79ada2397e5ac9304b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tzr3xdje.jgo.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4172-42-0x00000246002C0000-0x00000246002D0000-memory.dmp

Filesize
64KB

Download
memory/4172-30-0x0000024671A50000-0x0000024671A51000-memory.dmp

Filesize
4KB

Download
memory/4172-12-0x0000024671A50000-0x0000024671A51000-memory.dmp

Filesize
4KB

Download
memory/4172-67-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-35-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-38-0x0000024600280000-0x0000024600290000-memory.dmp

Filesize
64KB

Download
memory/4172-39-0x00000246002F0000-0x0000024600300000-memory.dmp

Filesize
64KB

Download
memory/4172-4-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-41-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-43-0x00000246002D0000-0x00000246002E0000-memory.dmp

Filesize
64KB

Download
memory/4172-46-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-47-0x0000024600320000-0x0000024600330000-memory.dmp

Filesize
64KB

Download
memory/4172-45-0x0000024600310000-0x0000024600320000-memory.dmp

Filesize
64KB

Download
memory/4172-44-0x0000024600300000-0x0000024600310000-memory.dmp

Filesize
64KB

Download
memory/4172-40-0x0000024600330000-0x0000024600340000-memory.dmp

Filesize
64KB

Download
memory/4172-48-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-24-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4172-17-0x0000024600000000-0x0000024601000000-memory.dmp

Filesize
16.0MB

Download
memory/4364-78-0x000001B530E40000-0x000001B530E50000-memory.dmp

Filesize
64KB

Download
memory/4364-94-0x000001B530F40000-0x000001B530F50000-memory.dmp

Filesize
64KB

Download
memory/4364-114-0x000001B539360000-0x000001B539361000-memory.dmp

Filesize
4KB

Download
memory/4364-113-0x000001B539250000-0x000001B539251000-memory.dmp

Filesize
4KB

Download
memory/4364-112-0x000001B539250000-0x000001B539251000-memory.dmp

Filesize
4KB

Download
memory/4364-110-0x000001B539220000-0x000001B539221000-memory.dmp

Filesize
4KB

Download
memory/4820-61-0x00007FFE4AB40000-0x00007FFE4B601000-memory.dmp

Filesize
10.8MB

Download
memory/4820-60-0x000002BBF7A60000-0x000002BBF7A82000-memory.dmp

Filesize
136KB

Download
memory/4820-73-0x00007FFE4AB40000-0x00007FFE4B601000-memory.dmp

Filesize
10.8MB

Download
memory/4820-63-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download
memory/4820-64-0x000002BBF7E20000-0x000002BBF7E64000-memory.dmp

Filesize
272KB

Download
memory/4820-76-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download
memory/4820-62-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download
memory/4820-68-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download
memory/4820-69-0x000002BBF7EB0000-0x000002BBF7ECE000-memory.dmp

Filesize
120KB

Download
memory/4820-65-0x000002BBF7EF0000-0x000002BBF7F66000-memory.dmp

Filesize
472KB

Download
memory/4820-74-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download
memory/4820-75-0x000002BBDD600000-0x000002BBDD610000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing