e35370cb7c8691b5fdd9f57f3f462807b40b067e305ce30eabc16e0642eca06b

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 16:30

Target

SalykFormJavaKZ.jar
Size

219KB
MD5

d0aed4975f9801c4b43148877db005f2
SHA1

db0a00cc513cf289d7cd7d63904b2298c0470421
SHA256

e35370cb7c8691b5fdd9f57f3f462807b40b067e305ce30eabc16e0642eca06b
SHA512

9ccbaf4c988abf8e4f32b8250510635bf6f4b40757c9b9521641c5fffc94f84207af9711fba8593904a6caf95e6c8eaae186c9ad14f47d519bd5929738bf226b
SSDEEP

3072:pCzWri3o5f2bxizASvhSkbExhjWtOdvubfIBVvaFo495OsqBMAM/eGJl825Miek:EV3U6MhSkbKldmIBVF4yBq/eslzGc

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4536 icacls.exe

pid	process
4536	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4364 wrote to memory of 4536 4364 java.exe icacls.exe
PID 4364 wrote to memory of 4536 4364 java.exe icacls.exe

description	pid	process	target process
PID 4364 wrote to memory of 4536	4364	java.exe	icacls.exe
PID 4364 wrote to memory of 4536	4364	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4536

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
43226da32e94692ac421279aaf83a91b

SHA1
440e38297c897986a66d81339dc2691a594537f0

SHA256
b4d90848f804a8eed8bb711c9621ee565814f74ef43ef982d0e1ff31f1f2e030

SHA512
aa93a89177a91bb3996e915509742efb6bfcaced81d7a1b059ba5a99dbb2581fd4964cec17ec61aa15894ec00c683fd1b5d3d8647cfd17fa18ec52b0dc3b92df

Download Submit
memory/4364-4-0x0000017648360000-0x0000017649360000-memory.dmp

Filesize
16.0MB

Download
memory/4364-12-0x0000017648340000-0x0000017648341000-memory.dmp

Filesize
4KB

Download
memory/4364-17-0x0000017648360000-0x0000017649360000-memory.dmp

Filesize
16.0MB

Download
memory/4364-24-0x0000017648360000-0x0000017649360000-memory.dmp

Filesize
16.0MB

Download
memory/4364-26-0x00000176485E0000-0x00000176485F0000-memory.dmp

Filesize
64KB

Download
memory/4364-27-0x0000017648600000-0x0000017648610000-memory.dmp

Filesize
64KB

Download
memory/4364-28-0x0000017648610000-0x0000017648620000-memory.dmp

Filesize
64KB

Download
memory/4364-29-0x0000017648360000-0x0000017649360000-memory.dmp

Filesize
16.0MB

Download