a0f4104801d1d248028bd51f896d752aef1f183c2d4f85a396234880dc3ce4a0

Analysis

max time kernel
132s
max time network
139s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23/02/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jre/desktop.jar
Size 65.9MB
Sample240223-rnfgwsah92
SHA256 fb3c1d4038dbcdedd268ad654c466023e636027cf80d7f4f452a1cfac7bb11b8
MD5 1fa23039a2e423db5c6f8f447cc618e2
SHA1 0bbf945d631c62e7b2f129d22fa12e9e1600697c
SHA512 f92b0e7f9e117555ce04da247aeec044394c37717f14dca2a55258944ea5902faa7b231b6f5d45aafa63db81dbcea10f77232d223e6bf1003baeec36fbd1d5a7
SSDEEP 1572864:PQGvH/hXAPC/hUdbNMit0PsxhAdyLSSsc+sN4pMG7BXhGo3vgC:PhvZYJV0Psxhqc+sN4GaXhGo9
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3132	java.exe
3132	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4448	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4448	3132	java.exe	76
PID 3132 wrote to memory of 4448	3132	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\desktop.jar
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7df0965166cfd04d1c4d90dc6572906521b38add5f19f3136dfb1b6140eef63f
MD5 c56857df44c17d4011dfc996993b65ff
SHA1 ad90fb3584552fe700c76799b038a714524b7cfb
SHA512 441ba32df7e3ac46e96c1f16bb7853a9132717c26b0445d2ce232894796319a2a8f680d62046992b1678e0f616191acbb19b050ac4b3bf645e62d8a78522ebdd
MD5 SHA1 SHA512

Submit Download

arc64.dll

Path \Users\Admin\AppData\Local\Temp\arc\5f24d8af\arc64.dll
Size 746KB
SHA256 d4c00d290f17de953de933552427b7ee717cd44cba20c451db8d3275241eb38b
MD5 adbf8c72d7e687eb6b21622c7edccaf8
SHA1 acbe605f81ab02240c1a3ee1dae6ec62c8df1789
SHA512 175f62fa4a6de41d1f0fd5b233ad7c65afacc0326eb9985d5e565c683a5d912b38b28cf22cdad65fa447734f2f7845ba126ad5f4a6741760e8f4c669b12b93c0
SSDEEP 12288:+0oR29hXME/JPXjMSuuzZcJlo6CGYMdFmQhXDEUxTjyesxJ4hOH+FUag:+09//lTMiy/wesx2QH+FUag
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdl-arc64.dll

Path \Users\Admin\AppData\Local\Temp\arc\d279e965\sdl-arc64.dll
Size 2.2MB
SHA256 97d0dff5e0c587c3bbab632e74ddb23a799977853120f1bd7dd07b1300f7de53
MD5 e928b2c23ec51c506771862e1f6c10e9
SHA1 2bb2d421607a676b0dc48a83fffe2c1c36583983
SHA512 d036dbc61246f0e7e7185449fbecb9c4b7814d7ba9d0647f18ccf5ddfb6d4bd969ddce2ebeb1f860cf356bcd244d1610de2b6bc342c54aeb26beef461285ba91
SSDEEP 49152:KY0ilbI7NFsF3AJv9oL+Ef5c6mIMkpecncRQ+Z:RbDEQ2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3132-4-0x000001CD8DD90000-0x000001CD8ED90000-memory.dmp

Download

memory/3132-12-0x000001CD8DD70000-0x000001CD8DD71000-memory.dmp

Download

memory/3132-21-0x000000006FEE0000-0x000000006FFA8000-memory.dmp

Download

memory/3132-22-0x000000006FC60000-0x000000006FEDC000-memory.dmp

Download

memory/3132-26-0x000000006FEE0000-0x000000006FFA8000-memory.dmp

Download

memory/3132-27-0x000000006FC60000-0x000000006FEDC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads