f94ac83ca87f16beb8dadebb57fc564a69c32416df82f5533699a395414356d1

Analysis

max time kernel
135s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Astolfo-Beta/natives/7202022.jar
Size

30.4MB
MD5

246338e7960eb8fd98e6b54a1ed0e976
SHA1

3b275061ee2073603b66e5a590e2d485d1005196
SHA256

782a65c650ffd376e241ea97e0c6448118cd04165fd7ec3413b76a5e2afaec98
SHA512

5a9d2972616e2222eac4f565ee2451af1efbe29b3f43a02f46266b5580471ab8451c8cd681512858e5ac2589711adac91fdace6d788a2baf9861b60b26e5267d
SSDEEP

786432:oCmyAD3HqH9eqiQVGF4iuIvU6guHcCl9TcES/x5:obuH9XeFub+cCl9Qn

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4640	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 4640	3808	java.exe	88
PID 3808 wrote to memory of 4640	3808	java.exe	88

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Astolfo-Beta\natives\7202022.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-4-0x0000025996B50000-0x0000025997B50000-memory.dmp

Filesize
16.0MB

Download
memory/3808-11-0x0000025995380000-0x0000025995381000-memory.dmp

Filesize
4KB

Download
memory/3808-13-0x0000025995380000-0x0000025995381000-memory.dmp

Filesize
4KB

Download