e06354fb296ca0a78daa2ed5c8a25fafac91109b9be5590c79032836b76244fe

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
W2-AND-1099-A_PDF.jar
Size 1.6MB
Sample240215-2vw4bsag3x
SHA256 d304fc7d28a123645a84a8af0ea3e79078b93c41ce27598f7184901599b81c20
MD5 b340226bafbd0ec63a660bba0b8396d1
SHA1 b481f6a4ea1e55a39bccf9efd0d9ce23b7901a2a
SHA512 48f7bd7fdf0ecdce324765b67c6de7ab2cd050e1bca970595bcf850820fc1e7be058b78db66cfeeb6ca056688dc3ad2bfa7cd1a5179b9d933775da8b7360be94
SSDEEP 49152:3P+edXjzD2yoPOJAK8FIB48FvST8dVRXFn57UW6rY:3haeJ++B4YiSfXFn5gW6s
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3916	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3916	744	java.exe	85
PID 744 wrote to memory of 3916	744	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\W2-AND-1099-A_PDF.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7e7570489b30c43d430e85a09986562800449b5d068edab512cfa0c542c8ec7f
MD5 08c77ce746d2741e8f14209fa70cb5a8
SHA1 8392cce678fdbf59a655ab8296a7e994bb55fa5d
SHA512 946d0451ca2d54782e4edb6af6cadb56d2b9119ab174f8d3293a01e33b0e7e49addf49390a6ac1edadef06fdde1bf307b9c0ba2e2c2560dc5053fe5025f374c2
MD5 SHA1 SHA512