Analysis

  • max time kernel
    95s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 12:11

General

  • Target

    lazy-language-loader-0.3.2.jar

  • Size

    24KB

  • MD5

    fd019656613f8cb6258b2bf315e4043d

  • SHA1

    d2f1d635aedbdb304c8c76a9476846e17396522b

  • SHA256

    2fdb5168bd72ba3a2c1f3e8cbca63de773a98dfd16066e157b301fd1e050214a

  • SHA512

    51f04a5dd41491b82136a4f0c49926694708f1394f44fad679a351965d49a9220442c0ed55ed7bed76c6f7bd10ad86afa8cb436b5726d0ba670b8e191ac5f839

  • SSDEEP

    768:IGJGBcqzH+auxglHSTMsZ1f3Ne1291m14f:fJVqzH+fghSYE1fda291F

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\lazy-language-loader-0.3.2.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:4916

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          4edaa1bb4fe7ec22d4862e05eab72946

          SHA1

          fd96a41fee624289bed95edf4c218a778113f0a8

          SHA256

          ad04cc5dc1278c796e326ba6e8cedf68b0736236f672a6b80ad63649f37fa7fb

          SHA512

          eb672c43c301dd76e0696b8925ce8e7b8f179c37ed506f5595ac840b4cf494b6b902caf43fd331249e24a143be1e0c3e731afda01c833b9ad226c6e76c3ae779

        • memory/3952-4-0x000001C087880000-0x000001C088880000-memory.dmp

          Filesize

          16.0MB

        • memory/3952-12-0x000001C085FA0000-0x000001C085FA1000-memory.dmp

          Filesize

          4KB