bb8d11e32e2918ab4542f7e2c7dd27678b514fae44ad108624f39b4fc7959d25

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 10:37

Target

Proof_of_Payment_Slip.jar
Size

437KB
MD5

322a1f9811848d3d87c324b4af80596a
SHA1

1d77bbd86bad82ada838430c036c42396381d4ba
SHA256

bb8d11e32e2918ab4542f7e2c7dd27678b514fae44ad108624f39b4fc7959d25
SHA512

cf3db249da705468548c32e70beee1493c7500ed555e165d859c3ae43d70eb4600c0244f35a1ad07f5ea31a5ec626db475bc68dd826a09a46d2b785a74fb5335
SSDEEP

12288:fhJjwzr5hk8GX9/eG/HuQk2PbDsQ2C8v31uQkJ:5FaO860G/HuQkIcgI31uQkJ

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2400 icacls.exe

pid	process
2400	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3184 wrote to memory of 2400 3184 java.exe icacls.exe
PID 3184 wrote to memory of 2400 3184 java.exe icacls.exe

description	pid	process	target process
PID 3184 wrote to memory of 2400	3184	java.exe	icacls.exe
PID 3184 wrote to memory of 2400	3184	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2400

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
83d7ae0a53da5e46caff277ceef77ec1

SHA1
8daf6b87ccd756cde1929d09fda66c12d7993647

SHA256
d21fc4d69b5079794327a900631f644e7274cf65849e1960768aced952980b82

SHA512
2da2b1b23c9418472402b66b103b80bc51fb488c7202e7d2c6ce6855a6dbaf8475541ae1ce43a03cbdfc6bdbd33de4b2b881db2fa41a4ea9c17ced195456c855

Download Submit
memory/3184-4-0x000002A8B83A0000-0x000002A8B93A0000-memory.dmp

Filesize
16.0MB

Download
memory/3184-12-0x000002A8B6B20000-0x000002A8B6B21000-memory.dmp

Filesize
4KB

Download
memory/3184-18-0x000002A8B83A0000-0x000002A8B93A0000-memory.dmp

Filesize
16.0MB

Download
memory/3184-20-0x000002A8B8630000-0x000002A8B8640000-memory.dmp

Filesize
64KB

Download
memory/3184-22-0x000002A8B8640000-0x000002A8B8650000-memory.dmp

Filesize
64KB

Download
memory/3184-21-0x000002A8B83A0000-0x000002A8B93A0000-memory.dmp

Filesize
16.0MB

Download
memory/3184-23-0x000002A8B83A0000-0x000002A8B93A0000-memory.dmp

Filesize
16.0MB

Download