461a433676e1cf327192d9f3b69c7d0a5f688b42359f81339f5a61bed9e5fbcf

Analysis

max time kernel
121s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Global Protect Desktop/.install4j/i4jruntime.jar
Size

1.9MB
MD5

c1b7e0b67222541df273442849cb913c
SHA1

70ae5d17d48d858f27a35e7198e3ff8a517d7375
SHA256

b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829
SHA512

6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254
SSDEEP

24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2040	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2040	2728	java.exe	86
PID 2728 wrote to memory of 2040	2728	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Global Protect Desktop\.install4j\i4jruntime.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-2-0x000002158AAF0000-0x000002158BAF0000-memory.dmp

Filesize
16.0MB

Download
memory/2728-11-0x000002158AAD0000-0x000002158AAD1000-memory.dmp

Filesize
4KB

Download
memory/2728-12-0x000002158AAF0000-0x000002158BAF0000-memory.dmp

Filesize
16.0MB

Download