Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 12:15
Behavioral task
behavioral1
Sample
a3c158be8374abd88fa2017ed42b1993.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3c158be8374abd88fa2017ed42b1993.jar
Resource
win10v2004-20240221-en
General
-
Target
a3c158be8374abd88fa2017ed42b1993.jar
-
Size
79KB
-
MD5
a3c158be8374abd88fa2017ed42b1993
-
SHA1
32a0e441efd32cfe7b052f4b39cec6bf7210ef0f
-
SHA256
541593de78f03a5c0fe6aa5146148b320daa1582e1940d8f53530daa9d839a18
-
SHA512
d3b15193f948d34bb6b7560e0fb51a228354bb3bf0c2b12836ebe38ac0e9f93968acff79d23d540c34f64c2ec241a4211a6e78613d4412362cfbff4f2eab22be
-
SSDEEP
1536:BUukjxiLjb9Atk31fd7UiBrqYYZ3Nz+2SN+n1cswwiCT3ZbR2OLaztWf31ns:ByjxiBAtuZjp/YNNz+2SN+n19di83ZbY
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 660 wrote to memory of 4788 660 java.exe icacls.exe PID 660 wrote to memory of 4788 660 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\a3c158be8374abd88fa2017ed42b1993.jar1⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD515740ec2dce69ec233aa58e73c4257c2
SHA13ed3ded7b594d69b77663b94702a64166afd8236
SHA256a0a056bfb655503b9d58d7170de700943238eb6f8ca9e28b4d8525d841d2ecb7
SHA512e7e131e3e7e233f49ddb2b89366752a703a4409e42b89c0ddf82df073cc6a7add47c1c2bbbf27bee2e232068f7433b78ec0ef0633c912fbee8616b54b78d775b
-
memory/660-47-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-28-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-50-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-64-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-62-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-32-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-37-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-45-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-46-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-4-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-16-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-18-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-26-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-83-0x0000020E49C80000-0x0000020E49C81000-memory.dmpFilesize
4KB
-
memory/660-96-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-106-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-110-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-113-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-116-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-120-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB
-
memory/660-122-0x0000020E4B450000-0x0000020E4C450000-memory.dmpFilesize
16.0MB