bb4598762ea768d8b238fa3b3f6b7f190d6af435f4ddaddc39e346b1d90e67e3

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fccbb8c65b7e15a1f93a26682606c59b.jar
Size 639KB
Sample240226-ejqe3scc26
SHA256 bb4598762ea768d8b238fa3b3f6b7f190d6af435f4ddaddc39e346b1d90e67e3
MD5 fccbb8c65b7e15a1f93a26682606c59b
SHA1 8b54db7eaec0500cf6c5f24bb538d1934123c850
SHA512 f406778afe01f5020dab1803799141a3c578f1f27cccb995f7b0f18362d241624a180d3d6e8c169c4aba8bd653767516eaeefb00f592b042d9973ff0fdbf97b2
SSDEEP 12288:GLzJQZ/Dbt0zx4xZIlsjgi/XRD+RjMNGPyg6NCRls3MuQ2V4SC9D82k:GLdQZl0F4/LjgipOiGPTEhMu9VDC9D8x
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
64	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
732	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 64	732	java.exe	86
PID 732 wrote to memory of 64	732	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\fccbb8c65b7e15a1f93a26682606c59b.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 09507ea1666915c5c47ffe9ae59e3185f07865f53d834897a559abde0f68e5a0
MD5 3275412a305b4a7422716037ff589809
SHA1 0b3bced29b4a197ead2d5c803a0379241a7b432b
SHA512 3df2d7c92d94f78358302c79c839064f0f74dced7a4dca87c8f1c9d7d6345b847e1677163dcee595852e470c49871c75c151bdfe9ace19c9260c04b9f22caddf
MD5 SHA1 SHA512

Submit Download

memory/732-4-0x000001B481410000-0x000001B482410000-memory.dmp

Download

memory/732-16-0x000001B4FFDD0000-0x000001B4FFDD1000-memory.dmp

Download

memory/732-19-0x000001B481410000-0x000001B482410000-memory.dmp

Download

memory/732-21-0x000001B481690000-0x000001B4816A0000-memory.dmp

Download

memory/732-22-0x000001B481410000-0x000001B482410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads