bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
93s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bin/searchengines.jar
Size 211KB
Sample240224-sd5jpsfh3w
SHA256 55ae370fbead97a8f0559c1854cf45ab16d9c80a338ccecd892c1a89bc70e235
MD5 8e8dbcc3789fa54726ae743faf020b0d
SHA1 e21427024b1820eca6b835c49193bb444be3b5e7
SHA512 0f6a5ac3eba373143fc6eeed0f26d9b076a304a448f80657d5b172d5e7a143289e9e840731babdf0d8a8c066d2025c12898d6b2aadecc24c899a0c53d5f14c1e
SSDEEP 3072:sLv4wM5kLFWScsyo66ZmJES0yyep/QLBI9v0ex55Fdn0/kmtZpUG0DPk+:sLAOLUsyo6BNdUi0rkMbUG0DD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1656	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1656	1720	java.exe	86
PID 1720 wrote to memory of 1656	1720	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\searchengines.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 57e7a0a4681aa4a616ab1cd80788e5d7245390e22c004fa691ad809b9419fa06
MD5 8366d7bcd98d1f4d1e01d49c5d78673c
SHA1 44fa0f6db305a6909e0cba9bc1e5a78133da490b
SHA512 6dc6d8fb694036a181ee1b273503f9b461a69f92e8fdb2a9a43248d7f49c90fdf595bddd623c7823547a7c520e8f075dd29ad87e93b1ceca8a4af69bca3be071
MD5 SHA1 SHA512

Submit Download

memory/1720-4-0x000001EFED170000-0x000001EFEE170000-memory.dmp

Download

memory/1720-12-0x000001EFED150000-0x000001EFED151000-memory.dmp