bef249e9f84cbcd9e19bdc2b610db4b9f72251cb71d4a99f04597019a43416f7

Analysis

max time kernel
180s
max time network
335s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
libs/MRJAdapter.jar
Size 59KB
Sample240224-sd5jpsfh3w
SHA256 46a3c20b1409cf5deda48c34bdce7e8b1492121ad59a264ecc54a20895b32a67
MD5 12975ecde03c3188c5c4a30307787a19
SHA1 ea32510f43ea89f7a4b34c1737c8fba5fc6e8c63
SHA512 7f424023b901c99ac28cbc274c38fe0d8da6c85fd892ad128e6e5127a0440290c8d5df386fc026f999bb345c4edd849dfa1c95d4d1607610804f1c259de134a1
SSDEEP 1536:ZA7FoXm4u3g8klZl8oa6onEm1uxGjrIhguNImfJnfb2qJx:y0Lu4E6wP1uxerIhXNzfHx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2228	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 2228	3384	java.exe	84
PID 3384 wrote to memory of 2228	3384	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\libs\MRJAdapter.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 9319548b0d06f806b9ad92eddc9883097731cffb41dc6d414045c607817ac662
MD5 bcddadb6dd33e118a2c483b5ce031114
SHA1 90ee306edf80b160c04f16a3d6584b7e47e78520
SHA512 9e4cb878261a4d884f4d426b3b90cd75efba7c647fa3a07fad0568956b64d9d7552ab427b7c45a975ffe10eb8c1ccb7517bcd769cd0b1b28aaf37819c800f8e5
MD5 SHA1 SHA512

Submit Download

memory/3384-5-0x000002428CC90000-0x000002428DC90000-memory.dmp

Download

memory/3384-11-0x000002428CC70000-0x000002428CC71000-memory.dmp