e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a

Resubmissions

24-02-2024 22:11

240224-138lnagd71 7

24-02-2024 22:08

21-02-2024 02:15

21-02-2024 01:57

21-02-2024 01:53

Analysis

max time kernel
26s
max time network
29s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
21-02-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Myau-240105-cracked (1).jar
Size

1.6MB
MD5

9115e3db16b63fb1a254f3bd57ad5893
SHA1

9c32dfffb1582ad8df15f4464b0a246d81b06f48
SHA256

e79735e48a7cdaaf0f91cffda247eea8a4bbebaf39aebccad54f4cf23b5e7f8a
SHA512

9b6481c30f5a58cdfca9d1702e059a46dfcdcb5773f1f6ef7d324050f287bd503159f316e7b0cedc2fe396326fd9e57685627c8257f4248e5057c0bbac78f77d
SSDEEP

24576:V96G/x8Z/QUTbjvgizYcftFdGmDAhQW3ZV2gDSGuGqZBXOYS8flT6lqYI:V9xxOBPrgGfDfDAKW3ZV2FLbZBeNYB

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1116	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1116	4904	java.exe	80
PID 4904 wrote to memory of 1116	4904	java.exe	80

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Myau-240105-cracked (1).jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4b8890318ed1ce518707f5cf481c2497

SHA1
b9887635845b6a98e6d8291d5924894673ac4211

SHA256
8d323e7fbf43285d42492d04e97890f543faf7c6c3300467481947201184ea57

SHA512
1c1458d02467890b574e4b62cb24b62a727efb77497972db9d59cdf2a2af4b7e86a096bf34fdb74c3dc4aab76dc75f4ea15234a3aaa83c38c2ee8021b46e85b7

Download Submit
memory/4904-4-0x000002BE41230000-0x000002BE42230000-memory.dmp

Filesize
16.0MB

Download
memory/4904-12-0x000002BE3FA00000-0x000002BE3FA01000-memory.dmp

Filesize
4KB

Download
memory/4904-13-0x000002BE41230000-0x000002BE42230000-memory.dmp

Filesize
16.0MB

Download