104a1989a48bab80eda619c30ce81fed272e8f777873d1080ec61cfe6a16a313

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 19:20

Target

W2-AND-1099-A_PDF.jar
Size

1.6MB
MD5

82bf005e3163f740bafec12af62dabe5
SHA1

8cb896a2cb7994ab767faad7e9af44ff3b076635
SHA256

569049ceea5edfe8be8baecc3392f7134fa4f3d6114073a3e4900341f8f587b8
SHA512

5955c8e5375668db364fa48a27e5ca58c8de179d3fab481ad9de8f59247e837d0654d70ee4e8a4e8830ad3e832d006c4eb675196fd2b9c470f6373c193f0c4cc
SSDEEP

24576:LxI2G49Vvr58ZAfpJSlGheLa/wCA9D35k3b1wxRUxd2BMiZEda7bF0Cw/BDhf7sZ:mxM18ZcrK/9D3O38mz3iZv7bkJq1BqbU

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4796 icacls.exe

pid	process
4796	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4228 wrote to memory of 4796 4228 java.exe icacls.exe
PID 4228 wrote to memory of 4796 4228 java.exe icacls.exe

description	pid	process	target process
PID 4228 wrote to memory of 4796	4228	java.exe	icacls.exe
PID 4228 wrote to memory of 4796	4228	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\W2-AND-1099-A_PDF.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4796

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4cfef3ee81b4995f08d1335630e5217c

SHA1
55f4396bbdc68bbb4170a0d880deed223491c7bf

SHA256
0d3145ea3837bc3f7ec3a4ceec80daba3e8f93a8626217eeeaaf90e3d5c8fdb8

SHA512
f587795f98f719888bca25691da4dbe0e436f16b3eda40c9c07b6a7c94b023122ddbf86219837259a1942140b22ab590fe679ed38cf1f44235ec6483831fff85

Download Submit
memory/4228-4-0x00000216B6530000-0x00000216B7530000-memory.dmp

Filesize
16.0MB

Download
memory/4228-12-0x00000216B4C60000-0x00000216B4C61000-memory.dmp

Filesize
4KB

Download
memory/4228-17-0x00000216B67B0000-0x00000216B67C0000-memory.dmp

Filesize
64KB

Download
memory/4228-18-0x00000216B6530000-0x00000216B7530000-memory.dmp

Filesize
16.0MB

Download
memory/4228-19-0x00000216B6530000-0x00000216B7530000-memory.dmp

Filesize
16.0MB

Download