8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249

Analysis

max time kernel
120s
max time network
134s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
21-02-2024 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment-Advice.jar
Size

1.8MB
MD5

bcd94e0661cd673bfcb79c368584a881
SHA1

0707033eecaa1c1b6add2c1e18731b92165954f1
SHA256

8d72ca85103f44742d04ebca02bff65788fe6b9fc6f5a411c707580d42bbd249
SHA512

acf7ec9ee4096f92e6fbd20fea09d077a364b6b16bf16bd1034885e6e25a9af39ce6b03a0b6e822cb11e29a02f48d83416ae7d1bd30188ebad5ab1f5a7c13c89
SSDEEP

49152:nw0Cbptl3ED+0iEeqRXbOog7tcnEivsBl5pvthNOZ8jipd9:n9at8+9XqRXbOenEivIlvtuZ8OpP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

java.exe

pid process

3400 java.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4328 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3400 wrote to memory of 4328 3400 java.exe icacls.exe
PID 3400 wrote to memory of 4328 3400 java.exe icacls.exe

pid	process
3400	java.exe

pid	process
4328	icacls.exe

description	pid	process	target process
PID 3400 wrote to memory of 4328	3400	java.exe	icacls.exe
PID 3400 wrote to memory of 4328	3400	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Payment-Advice.jar
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
64bbdbc6d43eb8f811c0f2cd40e70f5d

SHA1
b58738a703b6d266ce803d19ad6bcbc6c012f599

SHA256
618f307b35fd097bbb708e0f64908d18813ddaab575f5414935041756cdf75fd

SHA512
c6cd0e942474e4362c0d2674d62dad083fbdf5ecdf642b357e3929398bb6940d6b68e2e132f1d42b0fcd12b9156e23cb9a25ece2a6ebfcc32221ace2510da580

Download Submit
\Users\Admin\AppData\Local\Temp\sense_loader\CC00000065D107DB0001852344843412-1828159100_loader_windows_x64.dll
Filesize
61KB

MD5
45016b09b3b3b6239797b1bdf782c329

SHA1
e3da8b1f7f8a33422abc4fb74f9edc0a44c7b834

SHA256
4cb7ac4e7ba640da5a752977c83519f5c456b39783458c64669e80a938e36601

SHA512
fcad913fc2a83d026253d63f191224e62da6437894d1711430f5f5fd952e008f0518168b159c6ee369cd2d54fc930ae690dc1a37019e2ef45b04c8d2760882a7

Download Submit
memory/3400-35-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-17-0x0000028BA3320000-0x0000028BA3342000-memory.dmp

Filesize
136KB

Download
memory/3400-26-0x0000028BA3320000-0x0000028BA3342000-memory.dmp

Filesize
136KB

Download
memory/3400-27-0x0000028B8C690000-0x0000028B8C691000-memory.dmp

Filesize
4KB

Download
memory/3400-2-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-45-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-50-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-53-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-58-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-65-0x0000028B8DEC0000-0x0000028B8EEC0000-memory.dmp

Filesize
16.0MB

Download
memory/3400-69-0x0000028B8C690000-0x0000028B8C691000-memory.dmp

Filesize
4KB

Download