d21387f0e105c87fbe306d01cecb7b157ee02978875af513fc0733cbc5a52cf5

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a14320e418691e19a1dcc5fbb3a5c950.jar
Size

108KB
MD5

a14320e418691e19a1dcc5fbb3a5c950
SHA1

753ad196ba9325963be982be083defa61e58e876
SHA256

d21387f0e105c87fbe306d01cecb7b157ee02978875af513fc0733cbc5a52cf5
SHA512

da8b9b1693072b57cd181296ed5fd2f1e571b12d4c4419079e2bba07243aee7e772aa85009a8b97026207a3e8e9536144d005dbdd8a7a11d181d109578d1ebc8
SSDEEP

3072:bZ07hOYZ860cicigzJsJG+Aq1tb+xxgv6Y:tehOY/PicpCGnytb+xo

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5000 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4492 wrote to memory of 5000 4492 java.exe icacls.exe
PID 4492 wrote to memory of 5000 4492 java.exe icacls.exe

pid	process
5000	icacls.exe

description	pid	process	target process
PID 4492 wrote to memory of 5000	4492	java.exe	icacls.exe
PID 4492 wrote to memory of 5000	4492	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a14320e418691e19a1dcc5fbb3a5c950.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
24609653f56508b6fbdc70370375b752

SHA1
27bff246145e8cf648c4c0145331a7420a6bc4cd

SHA256
5b3b99cb29e01defcfceca26666374b5d52ce336e0b338258392ffbf27488d1c

SHA512
8f32c5d75464aa58bdaaa2be7d38e38e32d53496c5d5de9439a38cc199eed95889b41888ec74af9f40c098c931285a4064ee518aa18d5161ee5ca24997857233

Download Submit
memory/4492-31-0x000001D28DCF0000-0x000001D28DCF1000-memory.dmp

Filesize
4KB

Download
memory/4492-12-0x000001D28DCF0000-0x000001D28DCF1000-memory.dmp

Filesize
4KB

Download
memory/4492-18-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-26-0x000001D28DCF0000-0x000001D28DCF1000-memory.dmp

Filesize
4KB

Download
memory/4492-29-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-4-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-40-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-46-0x000001D28DCF0000-0x000001D28DCF1000-memory.dmp

Filesize
4KB

Download
memory/4492-48-0x000001D28DCF0000-0x000001D28DCF1000-memory.dmp

Filesize
4KB

Download
memory/4492-50-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-54-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download
memory/4492-82-0x000001D28DD10000-0x000001D28ED10000-memory.dmp

Filesize
16.0MB

Download