101f5ac48e9834e4c859678e56fda2bfa9f72f56a3249f053365e1efbe523ba1

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Crack/rlm1501.jar
Size

20KB
MD5

fe5711d6a27df13ad86027c75358ce65
SHA1

6934b1087e8dce41734248d47094b68ff3e0664f
SHA256

0310317ed3ffba9e95ba25a55745faf93bd487ea4e71cb5f6f637b412e1e740d
SHA512

edef6c976da0ebb5d35f231ad21d1f6f3ed4665f2c82296f861296e949d13f2174585589a16eb169aedd0b30bbd5460df9d1ff47a8c2bab6a031a9e4d0a3b9b3
SSDEEP

384:40gJlC/U75ZEFrZkNo+F7CY8e/YyqI24l+357e12ZN2Pe3Vg:TgJ4/U7sqVoEqI202ZN2Pe3Vg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1896	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1896	4596	java.exe	89
PID 4596 wrote to memory of 1896	4596	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Crack\rlm1501.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1d61346b2f5da0607509eead0eb15e11

SHA1
8788f38b3382e3048599d2efd356c27e6620ba35

SHA256
83ee266fa7c973eef42e04185d5db2e4157eaac932143b4048ecc8ca8a09d341

SHA512
09d0bb21f3ae399f6cecbaa0d8502976aafaaf09bd9a30d63a0e2032a6ca04572e7fb9506dc88dcaebdc4f30864a6244c4888702125b276a20cb83be2fd3c656

Download Submit
memory/4596-2-0x000001B6DEDA0000-0x000001B6DFDA0000-memory.dmp

Filesize
16.0MB

Download
memory/4596-12-0x000001B6DD570000-0x000001B6DD571000-memory.dmp

Filesize
4KB

Download