bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/ranktracker.jar
Size 362KB
Sample240224-sd5jpsfh3w
SHA256 92e4631b1766b6515a6796b3d568518988d53b0c4a24b0df588d2d58040c9be9
MD5 a2f4d650b6b4e479ff6295308847018e
SHA1 8b1a94c91bb309dbe589de7be4bd94d84de22b04
SHA512 80d286523fe811c7c3175b2f66716072c17fe137eefefdf17b25bddb33b1d0e4db4725b397cf85da16ea088aa828ed278f9b3801519c7171e8159e7bfaf89520
SSDEEP 6144:aJyDFMi/atvD4XCxYftKMzV4XJ2mTBm4eNWyu872B82AElq:RM97UCezVpP4uWydX2xlq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3396	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	java.exe
2552	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3396	2552	java.exe	88
PID 2552 wrote to memory of 3396	2552	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\ranktracker.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 23624085cd4388e540d9eb9f243b60e7eb6e8f888be6db642e78aa8eee68b545
MD5 6fb8f67b4ddbcac82103405aa35a1632
SHA1 87f2ebbe5c2b0289e4535a116a1362aebc6ca10f
SHA512 733632d8ae4bfb7b2c28c2ce229a6ea6bdaaeeaa807a081f067cf6984b5e2cbca51fbfbe374fcc6caeeb6fbdca276a4c5b55713d67c15fe59b8973a287feb8b1
MD5 SHA1 SHA512

Submit Download

memory/2552-4-0x0000028F80000000-0x0000028F81000000-memory.dmp

Download

memory/2552-16-0x0000028FF4AB0000-0x0000028FF4AB1000-memory.dmp

Download

memory/2552-18-0x0000028FF4AB0000-0x0000028FF4AB1000-memory.dmp

Download

memory/2552-23-0x0000028FF4AB0000-0x0000028FF4AB1000-memory.dmp

Download

memory/2552-26-0x0000028FF4AB0000-0x0000028FF4AB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads