82e880dd3b4bd3ebc7646c142c3d245abbc9e68e19b1d1b6062d5a699d075d5a

Resubmissions

19-02-2024 21:54

240219-1sewlaeb3s 7

19-02-2024 21:48

240219-1n3rvsee78 7

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vulcan-2.8.6.jar
Size

4.0MB
MD5

06d81251dbc874a35b9662c136a8a699
SHA1

f6fa278fa51959f0479bcd889183fe46e0cd3696
SHA256

82e880dd3b4bd3ebc7646c142c3d245abbc9e68e19b1d1b6062d5a699d075d5a
SHA512

86e917fe4916f578274d8ae7fe2eb708d11ad25ec7f3e870f373c73f326362d3cb91fa7ed7b8bbfb28269eafd0fd476c8938c68d673e3ba864bee3729f851ef5
SSDEEP

98304:2LbQPa9ua4ENDF3W2PUNIUqeRn/cWcRBz5w2WHb/4200c5Scxjgl:cx/NDw2PUNINe5/cvRBC2EAqb1l

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2596	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2596	3384	java.exe	85
PID 3384 wrote to memory of 2596	3384	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Vulcan-2.8.6.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6f8710548806abcf73863027bb317b8d

SHA1
e18d67d3fb53f506715f06b3fa29ee3c6b08f9ef

SHA256
e7f32f92ca75be6724b94cc822646c705d38b6119b2e3b457d6534d50db7d895

SHA512
9dae2c8d7da519d7f41203ab4d95f95729d6379ceabb75b91fccf09fd590183ce17aceb658fa9b9054161177c8b002519ffd13c5cde29fab10f48de0307874a9

Download Submit
memory/3384-2-0x0000026D5DB60000-0x0000026D5EB60000-memory.dmp

Filesize
16.0MB

Download
memory/3384-12-0x0000026D5DB40000-0x0000026D5DB41000-memory.dmp

Filesize
4KB

Download