24a053d6cc502fd913a382b1678621c80fbab6a1d449ea8cfe2b3fe8b4b64ae0

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libraries/com/google/code/gson/gson/2.2.4/gson-2.2.4.jar
Size 185KB
Sample240222-ymd11aeh69
SHA256 c0328cd07ca9e363a5acd00c1cf4afe8cf554bd6d373834981ba05cebec687fb
MD5 2f54fc24807a4cad7297012dd8cebf3d
SHA1 a60a5e993c98c864010053cb901b7eab25306568
SHA512 d7aa9214cefb99b2f39bab6bf5718dafcb43742f8a881e5fb6cbc3a757491c0082a536ed1fef6c7168412b6e5bdec28e68a40b4d4d0b57b63a7bbc9a55f820cd
SSDEEP 3072:kOTgHGrVYC19FDu9xp1BqCGmVas2lsKCFJYaseFPghVVv:bC8Y+9Bu9xp1Bq50a1sN0aox
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4984	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 4984	1204	java.exe	89
PID 1204 wrote to memory of 4984	1204	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\libraries\com\google\code\gson\gson\2.2.4\gson-2.2.4.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 cdaa8bbfac2718774ec4796030bd1c0d9d14cf26f7822fda77ad384818178f0e
MD5 fa5d50291836204bc58a88ad42264f86
SHA1 52401cb2fa2a69a97680aefccdda1e527dcbcbdd
SHA512 458d4eac2fb6e5c5fb6fc8a90d698dc96ba0f137466b91bda90a91e06c1edfa333285a1aa5fbaee89892a0671e3723b668ebc237d1172b891f8d45f587cace19
MD5 SHA1 SHA512

Submit Download

memory/1204-4-0x000002B25D580000-0x000002B25E580000-memory.dmp

Download

memory/1204-11-0x000002B25D560000-0x000002B25D561000-memory.dmp

Download

memory/1204-13-0x000002B25D580000-0x000002B25E580000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads