e06354fb296ca0a78daa2ed5c8a25fafac91109b9be5590c79032836b76244fe

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W2-AND-1099-A_PDF.jar
Size

1.6MB
MD5

b340226bafbd0ec63a660bba0b8396d1
SHA1

b481f6a4ea1e55a39bccf9efd0d9ce23b7901a2a
SHA256

d304fc7d28a123645a84a8af0ea3e79078b93c41ce27598f7184901599b81c20
SHA512

48f7bd7fdf0ecdce324765b67c6de7ab2cd050e1bca970595bcf850820fc1e7be058b78db66cfeeb6ca056688dc3ad2bfa7cd1a5179b9d933775da8b7360be94
SSDEEP

49152:3P+edXjzD2yoPOJAK8FIB48FvST8dVRXFn57UW6rY:3haeJ++B4YiSfXFn5gW6s

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3916	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3916	744	java.exe	85
PID 744 wrote to memory of 3916	744	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\W2-AND-1099-A_PDF.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
08c77ce746d2741e8f14209fa70cb5a8

SHA1
8392cce678fdbf59a655ab8296a7e994bb55fa5d

SHA256
7e7570489b30c43d430e85a09986562800449b5d068edab512cfa0c542c8ec7f

SHA512
946d0451ca2d54782e4edb6af6cadb56d2b9119ab174f8d3293a01e33b0e7e49addf49390a6ac1edadef06fdde1bf307b9c0ba2e2c2560dc5053fe5025f374c2

Download Submit
memory/744-4-0x0000020A5A310000-0x0000020A5B310000-memory.dmp

Filesize
16.0MB

Download
memory/744-12-0x0000020A58AC0000-0x0000020A58AC1000-memory.dmp

Filesize
4KB

Download