Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 23:13
Behavioral task
behavioral1
Sample
a4d701ab9770dada452925a014163a36.jar
Resource
win7-20240221-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4d701ab9770dada452925a014163a36.jar
Resource
win10v2004-20240221-en
2 signatures
150 seconds
General
-
Target
a4d701ab9770dada452925a014163a36.jar
-
Size
88KB
-
MD5
a4d701ab9770dada452925a014163a36
-
SHA1
081bbee5fda2159af6a0ec6a6db11bbba8e985f7
-
SHA256
48ba29328ad82dfd72bfac6eede576867ebf6f39ec0a7f1691201d1a10d299c9
-
SHA512
42ac4f0c615caefcedcdcde5e4ba25d612171017200cb46d89c692e88ca3d484f92d7ce0be6557665b5bd07e8bd47491b87dc75d9c186d39ecc304afd46feccd
-
SSDEEP
1536:wQxJoWyS7JljI8hGD767DzUWVFXUQugUt8ms4sRuZhuO8bNqg1r:wkvPhPXhugUKghuO8bN/r
Score
7/10
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 4544 wrote to memory of 932 4544 java.exe icacls.exe PID 4544 wrote to memory of 932 4544 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\a4d701ab9770dada452925a014163a36.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4544-2-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-11-0x000001A8907A0000-0x000001A8907A1000-memory.dmpFilesize
4KB
-
memory/4544-19-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-29-0x000001A8907A0000-0x000001A8907A1000-memory.dmpFilesize
4KB
-
memory/4544-31-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-38-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-48-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-52-0x000001A8907A0000-0x000001A8907A1000-memory.dmpFilesize
4KB
-
memory/4544-59-0x000001A892040000-0x000001A893040000-memory.dmpFilesize
16.0MB
-
memory/4544-61-0x000001A8907A0000-0x000001A8907A1000-memory.dmpFilesize
4KB
-
memory/4544-66-0x000001A8907A0000-0x000001A8907A1000-memory.dmpFilesize
4KB