Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
netty-all-4.0.23.Final.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
netty-all-4.0.23.Final.jar
Resource
win10v2004-20240221-en
General
-
Target
netty-all-4.0.23.Final.jar
-
Size
1.7MB
-
MD5
4725826ca7ba3713db6748ee8f3906c3
-
SHA1
0294104aaf1781d6a56a07d561e792c5d0c95f45
-
SHA256
50510e9c9874b539b98ef931fe7eeeb002f6b5b1976ea37669b9493426294561
-
SHA512
80fcf9653620a614fb444d039c8bd8c195db25cb16f39ccccd87c1434fbc836c66f792e7717cc989b66d57c0a86365b8ae051c107916c231d4ecd0b4d2908490
-
SSDEEP
24576:eTZZySEwtY+G2WZeW58R8ThJZw62EgC6fCyL1zjLr6NewH5pWzwNdemBpC7+RjiM:Qz1En2WX8qXK62666UzvWDZrNdemBmOz
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 4864 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4864 2960 java.exe 87 PID 2960 wrote to memory of 4864 2960 java.exe 87
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\netty-all-4.0.23.Final.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD51eeba877b4898f796591c5255cfd07c8
SHA189c6277eab47adebca28bcbaa1e6425f6497491d
SHA2561fbe96c3f302704fbe6457a65d265554393da5fc2f8c102d246842a0d4649ef4
SHA5129a1c019beb0ec08998ae7c06ff0151addc85f76a42e3563ed96aea09dcebeab66686abf93b2624c96143f0b25ef989a3f40de4edbefa99996661135ce856a13d