bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/linkassistant.jar
Size 946KB
Sample240224-sd5jpsfh3w
SHA256 021254fc82b0ea62ada1a12b7870d35e165b2acd59e806cd2f14fb5b0c4b6435
MD5 476d0285e487c8680b01ede2d15f8246
SHA1 fbe2f82e21aa73324693ec22335b48cba25b9f2b
SHA512 23194d3cfce854f552cb9b36c05fe5071b9e9e692fd31443014d4190b18e236e68bf4d4d68115c5131f95036daf3dada509901cd7639e115e8b60dff4f780dcb
SSDEEP 24576:ejOOvmodaQ4hiNabOL5FNHM6nOEe+bXyPN3BoNH5m:khmoIQ4HCe6OMXyPN3Oc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1840	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 1840	4976	java.exe	88
PID 4976 wrote to memory of 1840	4976	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\linkassistant.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 2af3297b8f978055b0111423f06345e1187e06a1eed278187103fe396fc97001
MD5 6e6abb7ef59e11549f3ee0220e4eff9a
SHA1 1401e9b11dad414444833cf80f38b9cced4c318e
SHA512 401f6c884de07134c0262976a98a80a37e78b3448b5842d1fa06917290a66454cab07e4ffa16efa0f077365d8538602c517ee725f7a60696cbdb7435331b761e
MD5 SHA1 SHA512

Submit Download

memory/4976-2-0x0000017430AE0000-0x0000017431AE0000-memory.dmp

Download

memory/4976-13-0x000001742F290000-0x000001742F291000-memory.dmp