Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2024 19:41
Behavioral task
behavioral1
Sample
FACTURA DE PROFORMA.jar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
FACTURA DE PROFORMA.jar
Resource
win10v2004-20231215-en
General
-
Target
FACTURA DE PROFORMA.jar
-
Size
209KB
-
MD5
82ddfae819b4cb46144b03c2d68377fb
-
SHA1
49d56b3c003c095d746c1fe3500dd06f4eacb704
-
SHA256
6b227cc81bae5fbe74537e84b2a57c5761a63b0b6bf26f84c305e56c2c4255ca
-
SHA512
ffb16eda0f7e103bec6fff763b98d7f66ef4b50391c5b8e3baeb1a68c6f03d79f7741100be1064bc16fb2e196ee22b4a2986cbc5e04f47826f7a572e9d758957
-
SSDEEP
6144:0sC8dJ2Hf/ljpxyAzy7RpUV7ly1TuVPYVmyKg:0sbdo3j0Aci7ly1mIKg
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 4464 wrote to memory of 2564 4464 java.exe icacls.exe PID 4464 wrote to memory of 2564 4464 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\FACTURA DE PROFORMA.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5a64fe82ff96d5f636290eb8079e67ac7
SHA14ee45f24e1ff8032506590a430c774e75e7df813
SHA256e2a2f5a7835202626d1e7e4ab1625757dc473c249c5c036cbe298c45cf9d1f22
SHA512adc2b168d417dabdd6493cfa6582a9d75fd15fc82f39cf7e5ba52ab5ecc71031c48e3f03b330f93f6f39a3197c02b9eb84dcce308c00b8d4a5a28b5a45887d1c
-
memory/4464-48-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-57-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-18-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-24-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-29-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-31-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-15-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-2-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-40-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB
-
memory/4464-59-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-65-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-70-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-84-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-104-0x000001DAA6810000-0x000001DAA6811000-memory.dmpFilesize
4KB
-
memory/4464-122-0x000001DAA6830000-0x000001DAA7830000-memory.dmpFilesize
16.0MB