7a9a9636399f4839c48b9f1b06708eafcfab8fe623cb80e758c986ddf046df13

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/.install4j/i4jruntime.jar
Size

1.9MB
MD5

c1b7e0b67222541df273442849cb913c
SHA1

70ae5d17d48d858f27a35e7198e3ff8a517d7375
SHA256

b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829
SHA512

6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254
SSDEEP

24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4796	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4796	3100	java.exe	85
PID 3100 wrote to memory of 4796	3100	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4jruntime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
97a4729414f0314d3d9bf817221c1c11

SHA1
9e8383873f5d230ca710ce4ea2ae3ac4b327709b

SHA256
636d12698449cd24ea0de6dfae5a935a98ac98367c50421c8b3ce19eda73972d

SHA512
33def7f1b55322d8ca9eb182240ac6434e23aa1ec9262239d7a3f688a7edee6a17af5142c574d913428334da7b5ec4aa64848039bc475b0906bba745897426b9

Download Submit
memory/3100-2-0x000001F4508A0000-0x000001F4518A0000-memory.dmp

Filesize
16.0MB

Download
memory/3100-12-0x000001F44F050000-0x000001F44F051000-memory.dmp

Filesize
4KB

Download