461a433676e1cf327192d9f3b69c7d0a5f688b42359f81339f5a61bed9e5fbcf

Analysis

max time kernel
142s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Global Protect Desktop/.install4j/user/flatlaf.jar
Size

567KB
MD5

de36b2deec6741f742cfc65e7b4942c9
SHA1

b340f36ab424075477f28076053383f5496b5f0f
SHA256

0dec40ef8e67d1fe6140832808be2cf85bb5110b78266a6117b0be068bb343d4
SHA512

91c82273f0998ab1b16403089807704e392ba8002cabfcb53f5c4958c2aeca3d1caf2911aeaadc486a124b133ebd14104f9ff695c766ab3d625e5d0bb49cc24f
SSDEEP

12288:0j1dtDcKKsj/WgXc8dXX+PHjBbhPX+yj0xcNheuE+zl/:0j1ncKKsVrXUvOyj0SNhWSl/

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2368	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2368	768	java.exe	89
PID 768 wrote to memory of 2368	768	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Global Protect Desktop\.install4j\user\flatlaf.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
0cdec6dedabc262192eb93beef6bec5c

SHA1
e068e59281e9b740790ff9a87f319843b1d7e87c

SHA256
3601a199b39dd68d14004f03e5371e308f7339f0535bb1efb13822d54a992a5e

SHA512
f2473021d816ddb51cbfa13b51210092ba04f0be12e03edd28542b37bb2ef4a88f9669ae10fab387857fbea413d81ad63d2ed6f529e4e2347a241f0e803ca358

Download Submit
memory/768-4-0x000001E5B9430000-0x000001E5BA430000-memory.dmp

Filesize
16.0MB

Download
memory/768-12-0x000001E5B9410000-0x000001E5B9411000-memory.dmp

Filesize
4KB

Download