8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-02-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249.jar
Size

1.8MB
MD5

bcd94e0661cd673bfcb79c368584a881
SHA1

0707033eecaa1c1b6add2c1e18731b92165954f1
SHA256

8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249
SHA512

acf7ec9ee4096f92e6fbd20fea09d077a364b6b16bf16bd1034885e6e25a9af39ce6b03a0b6e822cb11e29a02f48d83416ae7d1bd30188ebad5ab1f5a7c13c89
SSDEEP

49152:nw0Cbptl3ED+0iEeqRXbOog7tcnEivsBl5pvthNOZ8jipd9:n9at8+9XqRXbOenEivIlvtuZ8OpP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

4600 java.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4996 icacls.exe

pid	process
4600	java.exe

pid	process
4996	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4600 wrote to memory of 4996 4600 java.exe icacls.exe
PID 4600 wrote to memory of 4996 4600 java.exe icacls.exe

description	pid	process	target process
PID 4600 wrote to memory of 4996	4600	java.exe	icacls.exe
PID 4600 wrote to memory of 4996	4600	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249.jar
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
cca6763af8ba749e44b354a0c3a80b7e

SHA1
2cd6c57d069ae1b1c9c5e0dd2a5112f7c71533a9

SHA256
8e28fb71cdd7dc0d3e3c77f282dbe1ff57ab34f2fd70b20508df5651bb05495c

SHA512
6ccae584cfaf348ad1c277d3b908844730d0d4524e493bb839aa5ea1da3a3120947c1adf2c3e9c244dc875ce4b638f8757c60fbc858542f284236b421e698ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\sense_loader\CC00000065D107DB0001852344843412-1828159100_loader_windows_x64.dll
Filesize
1.1MB

MD5
4f0b3278efcdc43470f75edb7fdb84cb

SHA1
8096149292d77825225bae4368bcc219df9bf98a

SHA256
b4183370b1e9c092f4ba706b10109e2e8514969b92fc76875780a2442fd348aa

SHA512
c007b4e65afd821a15ebdef95a1bf41ca02023bda1227a4a6373dd58d5b665dc783d1bbe312e95be1824b1817465ee7f0b58c820e64a7da009cf6118a81a48f6

Download Submit
memory/4600-54-0x0000027DD84F0000-0x0000027DD8500000-memory.dmp

Filesize
64KB

Download
memory/4600-55-0x0000027DD8570000-0x0000027DD8580000-memory.dmp

Filesize
64KB

Download
memory/4600-26-0x0000027DED740000-0x0000027DED762000-memory.dmp

Filesize
136KB

Download
memory/4600-27-0x0000027DD6A90000-0x0000027DD6A91000-memory.dmp

Filesize
4KB

Download
memory/4600-33-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-43-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-49-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-51-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-4-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-16-0x0000027DED740000-0x0000027DED762000-memory.dmp

Filesize
136KB

Download
memory/4600-56-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-57-0x0000027DD8540000-0x0000027DD8550000-memory.dmp

Filesize
64KB

Download
memory/4600-58-0x0000027DD8560000-0x0000027DD8570000-memory.dmp

Filesize
64KB

Download
memory/4600-60-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-59-0x0000027DD8580000-0x0000027DD8590000-memory.dmp

Filesize
64KB

Download
memory/4600-62-0x0000027DD85B0000-0x0000027DD85C0000-memory.dmp

Filesize
64KB

Download
memory/4600-61-0x0000027DD8590000-0x0000027DD85A0000-memory.dmp

Filesize
64KB

Download
memory/4600-63-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download
memory/4600-64-0x0000027DD8270000-0x0000027DD9270000-memory.dmp

Filesize
16.0MB

Download