Analysis
- max time kernel
93s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
20/02/2024, 02:46
General
- Target 6b227cc81bae5fbe74537e84b2a57c5761a63b0b6bf26f84c305e56c2c4255ca.jar
- Size 209KB
- Sample240220-c9b92aac83
- SHA256 6b227cc81bae5fbe74537e84b2a57c5761a63b0b6bf26f84c305e56c2c4255ca
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\6b227cc81bae5fbe74537e84b2a57c5761a63b0b6bf26f84c305e56c2c4255ca.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/2132-36-0x000001FBB9350000-0x000001FBB9360000-memory.dmp
memory/2132-39-0x000001FBB9360000-0x000001FBB9370000-memory.dmp
memory/2132-16-0x000001FBB7870000-0x000001FBB7871000-memory.dmp
memory/2132-22-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-30-0x000001FBB7870000-0x000001FBB7871000-memory.dmp
memory/2132-32-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-15-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-37-0x000001FBB9390000-0x000001FBB93A0000-memory.dmp
memory/2132-35-0x000001FBB9310000-0x000001FBB9320000-memory.dmp
memory/2132-38-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-4-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-40-0x000001FBB9370000-0x000001FBB9380000-memory.dmp
memory/2132-41-0x000001FBB93A0000-0x000001FBB93B0000-memory.dmp
memory/2132-42-0x000001FBB9090000-0x000001FBBA090000-memory.dmp
memory/2132-43-0x000001FBB9090000-0x000001FBBA090000-memory.dmp