d0c7d45da838c5c08119c59036ccce877fd7d2fc1c91e0d54268bedc5efc4120

Analysis

max time kernel
91s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SKM_C258201001130020005057.jar
Size

107KB
MD5

bf9f710ba1787558944c14a51c3caab8
SHA1

8ae1f0e795b1aadc692964ac6ee27127fb7d6644
SHA256

d12c23844f090115e9ab57ad9d53fefe49dbbe05a1766551d6b0dd916451965e
SHA512

6b9d951521628e0fa58158e29d9dbeb511c053824575815c943d06f5d98375b7333be4f4cedcd4d864714735a8f9633bd960a58c0f177d7391de272e6a61ccf5
SSDEEP

1536:JbnFYRwaRs91zJuDt6IulM3p6crzdUKW3CwxC5MQAssDgRmAWYGfq6gbyoLGgFo:kG91zaL3Usxe3S5AssDYvGi6g2hD

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1972	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1972	3936	java.exe	85
PID 3936 wrote to memory of 1972	3936	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SKM_C258201001130020005057.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4a86702fa64beff58e8a934627a8ed4b

SHA1
31332ee1c5e614da3280331a8ddb8adff2ca5319

SHA256
90ed7bba15cab9e14514bb14d68a35690413935ac63b26ed46569a91fd9b2e24

SHA512
c130d58af5309a7fa1da50d13e5ff696156814601191092fa4abd7ec03cbee4a18fe44d3afe4635f15526c08add1a26161b2c8671f96e133e0dad759c73ab6e8

Download Submit
memory/3936-4-0x0000020096160000-0x0000020097160000-memory.dmp

Filesize
16.0MB

Download
memory/3936-17-0x0000020096160000-0x0000020097160000-memory.dmp

Filesize
16.0MB

Download
memory/3936-19-0x00000200963F0000-0x0000020096400000-memory.dmp

Filesize
64KB

Download
memory/3936-20-0x00000200963E0000-0x00000200963F0000-memory.dmp

Filesize
64KB

Download
memory/3936-21-0x0000020096400000-0x0000020096410000-memory.dmp

Filesize
64KB

Download
memory/3936-22-0x0000020096160000-0x0000020097160000-memory.dmp

Filesize
16.0MB

Download