Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 19:53

General

  • Target

    libraries/commons-codec/commons-codec/1.9/commons-codec-1.9.jar

  • Size

    257KB

  • MD5

    75615356605c8128013da9e3ac62a249

  • SHA1

    9ce04e34240f674bc72680f8b843b1457383161a

  • SHA256

    ad19d2601c3abf0b946b5c3a4113e226a8c1e3305e395b90013b78dd94a723ce

  • SHA512

    b65531ead8500493e3dd14a860224851b80f438fc53bf8868b443a0557d839a2b0c868e4fedcf99579ae04b6b2bbd8cdb37f9921ad785983c37569aa9d2e8102

  • SSDEEP

    6144:7P1UfNFAs0rRzuGrHfumymG2w63GhctKS/VTcbbNbIR:7P8AsoRNrHfumy1pRyQnNbY

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\libraries\commons-codec\commons-codec\1.9\commons-codec-1.9.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1988

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          a1b786efc64f4027987de1933d259a3e

          SHA1

          6f1865b9bcac7eb857cec30fc6a87010770a8b4b

          SHA256

          b3e4a54696426f2a6f950faafd78d7c25bd52d1ca76b4f14f6bb775415f4f446

          SHA512

          e7ebbc7e8183e5dc3afd2868f1b053803e16bf76e429be39441c46e23714ce690dcd805cbdb677b48a06ab97733f99d397721db3a6c651549cfe4364fa895bd1

        • memory/3824-4-0x00000261AC4E0000-0x00000261AD4E0000-memory.dmp

          Filesize

          16.0MB

        • memory/3824-12-0x00000261AC4C0000-0x00000261AC4C1000-memory.dmp

          Filesize

          4KB