e06354fb296ca0a78daa2ed5c8a25fafac91109b9be5590c79032836b76244fe

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2024 22:54

Target

W2-AND-1099-A_PDF.jar
Size

1.6MB
MD5

b340226bafbd0ec63a660bba0b8396d1
SHA1

b481f6a4ea1e55a39bccf9efd0d9ce23b7901a2a
SHA256

d304fc7d28a123645a84a8af0ea3e79078b93c41ce27598f7184901599b81c20
SHA512

48f7bd7fdf0ecdce324765b67c6de7ab2cd050e1bca970595bcf850820fc1e7be058b78db66cfeeb6ca056688dc3ad2bfa7cd1a5179b9d933775da8b7360be94
SSDEEP

49152:3P+edXjzD2yoPOJAK8FIB48FvST8dVRXFn57UW6rY:3haeJ++B4YiSfXFn5gW6s

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3916 icacls.exe

pid	process
3916	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 744 wrote to memory of 3916 744 java.exe icacls.exe
PID 744 wrote to memory of 3916 744 java.exe icacls.exe

description	pid	process	target process
PID 744 wrote to memory of 3916	744	java.exe	icacls.exe
PID 744 wrote to memory of 3916	744	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
08c77ce746d2741e8f14209fa70cb5a8

SHA1
8392cce678fdbf59a655ab8296a7e994bb55fa5d

SHA256
7e7570489b30c43d430e85a09986562800449b5d068edab512cfa0c542c8ec7f

SHA512
946d0451ca2d54782e4edb6af6cadb56d2b9119ab174f8d3293a01e33b0e7e49addf49390a6ac1edadef06fdde1bf307b9c0ba2e2c2560dc5053fe5025f374c2

Download Submit
memory/744-4-0x0000020A5A310000-0x0000020A5B310000-memory.dmp

Filesize
16.0MB

Download
memory/744-12-0x0000020A58AC0000-0x0000020A58AC1000-memory.dmp

Filesize
4KB

Download