3a1f6872728b85b1777450badac363ede549d11d2144b5af35035c1e0da60de9

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 14:29

Target

a405af40a581ee2f0408f195eac26dc9.jar
Size

99KB
MD5

a405af40a581ee2f0408f195eac26dc9
SHA1

89070bac1eff692f089c431d6b95ad64095e77c9
SHA256

3a1f6872728b85b1777450badac363ede549d11d2144b5af35035c1e0da60de9
SHA512

8fcd879ecb732b1c953dfd3a73b5433357fa56f850f99b202504828e8f1b8b2a6b3ec5f69c062480b14530468b3b60695fc52b5c47682d9b653b78b68797b59c
SSDEEP

3072:qES7fGr+2adei9woomfn9FvfjxJOFlPDtH:qES4+2adbH7fjfIDtH

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3796 icacls.exe

pid	process
3796	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1536 wrote to memory of 3796 1536 java.exe icacls.exe
PID 1536 wrote to memory of 3796 1536 java.exe icacls.exe

description	pid	process	target process
PID 1536 wrote to memory of 3796	1536	java.exe	icacls.exe
PID 1536 wrote to memory of 3796	1536	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3796

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
ecb79337bb96d7f28445e873e81a00c2

SHA1
0ecf2824be8cfb707526e5f46ca4bc319405c643

SHA256
59b295cb22227bac9c7c2b9af2a960d8cc684f2da2aa5933e95d448c9cdfb771

SHA512
3bd9483f64118b8324029752111932d016b42dc737cfbf42584362ca6804524188270e4bfdd0e85c40bece2a64fb69f6c951c3dfc592decff84a9eb8ade5aba2

Download Submit
memory/1536-2-0x000001E12CCE0000-0x000001E12DCE0000-memory.dmp

Filesize
16.0MB

Download
memory/1536-12-0x000001E12B4C0000-0x000001E12B4C1000-memory.dmp

Filesize
4KB

Download
memory/1536-21-0x000001E12CCE0000-0x000001E12DCE0000-memory.dmp

Filesize
16.0MB

Download
memory/1536-22-0x000001E12CF60000-0x000001E12CF70000-memory.dmp

Filesize
64KB

Download
memory/1536-23-0x000001E12CF70000-0x000001E12CF80000-memory.dmp

Filesize
64KB

Download
memory/1536-24-0x000001E12CCE0000-0x000001E12DCE0000-memory.dmp

Filesize
16.0MB

Download