bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
124s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/htmlparser.jar
Size 320KB
Sample240224-sd5jpsfh3w
SHA256 edb0db9a021b98600f544dc2a7a61a6f231ae7396539f0b2d0ede71fb0446086
MD5 7b7fce66e5ec66619a5b662f24db53e6
SHA1 eecfb0bbe8c6a1f54da2e92b925e0b40d1539240
SHA512 30f26d49d5ec9d01376e11ebf4b8bae96a4691ea6c401fa980cd5aca3637b238e802a2a58b91bf821dcad12dc63ecf84cf8d66e63c355831f43702d3b381ac20
SSDEEP 6144:MXQHj4NsExwDuzpwmJHggpsZcbdAtbemyOA7dqk9wNWe7k:kUjMpzApdUmyOsdqkA7k
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2512	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2512	2908	java.exe	91
PID 2908 wrote to memory of 2512	2908	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\htmlparser.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 72526d33526d817b711f3b4e91c96f2b7c5d7083023499f6eb46b7269008533e
MD5 6233d3c755f39b5625dc027984792083
SHA1 8031548ff414d7b59224ca532ef7f36819b6511b
SHA512 8fb924ac578df5d084a83c527d120e91ebb04fe83504a9092ec4516df6d64831b408fb02b1893d0f309d6d2761cf2954379d98d5fa6cdb1ff379616b028c5b3c
MD5 SHA1 SHA512

Submit Download

memory/2908-2-0x0000022209FD0000-0x000002220AFD0000-memory.dmp

Download

memory/2908-12-0x0000022208790000-0x0000022208791000-memory.dmp