a0f4104801d1d248028bd51f896d752aef1f183c2d4f85a396234880dc3ce4a0

Analysis

max time kernel
128s
max time network
137s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23/02/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jre/lib/jrt-fs.jar
Size 106KB
Sample240223-rnfgwsah92
SHA256 55713bb4fcc81ce5b952320b8ab4c424e3041435b7643e8abe98a8750bef3348
MD5 54eb57a9786300dc8707fcea594b89f4
SHA1 70a3aee3a195cb9cf100fd14eff370ae314ad64d
SHA512 69f60ee4f0d507c21b05da2affde970a1a72bf9b6de2bdf67a1bc378c2c2bc7892cf912f5efdbe51c72d41ccdeeceba45cfa684f48d1288fcffbf8fae255fc26
SSDEEP 3072:7y6cONlUnYTPbfH6gqAmH7l0aQ7vY9mNnzahGBJaY7Tb:75dlUqWk87l4FRMGbLv
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4008	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4008	4404	java.exe	73
PID 4404 wrote to memory of 4008	4404	java.exe	73

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jrt-fs.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 47fbeb8f89ecd1219576eb7cef20e3633fd57a522599ddd5bd7f73ff493bb5f2
MD5 b0b0fd98e161370ec188062b06d5eb35
SHA1 5b108187d0232feb3779169f1225aeef9c5c8955
SHA512 cb10ee08cff63e356d72207081d0f1b8d5bf7937a6430cfaa135e2ddb53e375ccc555a80fc4adb616bc2c2c9533aaa4e343b9d12dd030e8fbf92a22da520348f
MD5 SHA1 SHA512

Submit Download

memory/4404-4-0x0000018289F10000-0x000001828AF10000-memory.dmp

Download

memory/4404-11-0x0000018288620000-0x0000018288621000-memory.dmp

Download

memory/4404-13-0x0000018289F10000-0x000001828AF10000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads