8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment-Advice.jar
Size 1.8MB
Sample240219-khkfbsbf59
SHA256 8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249
MD5 bcd94e0661cd673bfcb79c368584a881
SHA1 0707033eecaa1c1b6add2c1e18731b92165954f1
SHA512 acf7ec9ee4096f92e6fbd20fea09d077a364b6b16bf16bd1034885e6e25a9af39ce6b03a0b6e822cb11e29a02f48d83416ae7d1bd30188ebad5ab1f5a7c13c89
SSDEEP 49152:nw0Cbptl3ED+0iEeqRXbOog7tcnEivsBl5pvthNOZ8jipd9:n9at8+9XqRXbOenEivIlvtuZ8OpP
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4568	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1352	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 1352	4568	java.exe	85
PID 4568 wrote to memory of 1352	4568	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Payment-Advice.jar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 61dfde4c52ffac1b5c5da40b3c4f81a59f08d112d41c2eb46ee638ca749e5b3a
MD5 b574d05b3cebea6fb58fb065729098ea
SHA1 13653cdf206a53d404b4b037ea51c6a8973ff645
SHA512 320574e9c1400c28d29352a748fa98eef6bb90992df0842f4e9cbc63e8d033fa8b4be804619a1229bbd70a219674184be4a7d9dd070344db5bc8009d1dd779cd
MD5 SHA1 SHA512

Submit Download

CC00000065D107DB0001852344843412-1828159100_loader_windows_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\sense_loader\CC00000065D107DB0001852344843412-1828159100_loader_windows_x64.dll
Size 1.1MB
SHA256 b4183370b1e9c092f4ba706b10109e2e8514969b92fc76875780a2442fd348aa
MD5 4f0b3278efcdc43470f75edb7fdb84cb
SHA1 8096149292d77825225bae4368bcc219df9bf98a
SHA512 c007b4e65afd821a15ebdef95a1bf41ca02023bda1227a4a6373dd58d5b665dc783d1bbe312e95be1824b1817465ee7f0b58c820e64a7da009cf6118a81a48f6
SSDEEP 12288:qoY7w1zXMZJPQDoFq80Yx2PLRgKy2vQ6yXR0nEvLLjzBxQuRWeihUIIQxraMpKTz:0w1DUL9uuyKXFTRFmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4568-48-0x00000253A9C60000-0x00000253A9C70000-memory.dmp

Download

memory/4568-50-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

memory/4568-14-0x00000253A81F0000-0x00000253A81F1000-memory.dmp

Download

memory/4568-27-0x00000253BEE80000-0x00000253BEEA2000-memory.dmp

Download

memory/4568-35-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

memory/4568-40-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

memory/4568-4-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

memory/4568-18-0x00000253BEE80000-0x00000253BEEA2000-memory.dmp

Download

memory/4568-52-0x00000253A9CA0000-0x00000253A9CB0000-memory.dmp

Download

memory/4568-53-0x00000253A9CB0000-0x00000253A9CC0000-memory.dmp

Download

memory/4568-51-0x00000253A9C90000-0x00000253A9CA0000-memory.dmp

Download

memory/4568-49-0x00000253A9CC0000-0x00000253A9CD0000-memory.dmp

Download

memory/4568-54-0x00000253A9CE0000-0x00000253A9CF0000-memory.dmp

Download

memory/4568-55-0x00000253A9CF0000-0x00000253A9D00000-memory.dmp

Download

memory/4568-56-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

memory/4568-57-0x00000253A99E0000-0x00000253AA9E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads