29fad6e1f4b1359c780d8b0d582e20928224a16b028f0f0cb7dec464b902a50d

Analysis

max time kernel
136s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aac5d2ef572e27c2cf7fa45f364b29f6.jar
Size

101KB
MD5

aac5d2ef572e27c2cf7fa45f364b29f6
SHA1

5a0abbeecb14d5dd5e5057dc748a0e4676ee5db8
SHA256

29fad6e1f4b1359c780d8b0d582e20928224a16b028f0f0cb7dec464b902a50d
SHA512

0c5a19faeee23165258fdf7696eec1ea1f8f50e1b35481a0e9f2ecc7cafd85d0009aeecf512f3a3a813cda96827e7b2cd0b48af14ad7df7f07548166d3b338e9
SSDEEP

3072:DkimTCP69UCzO5qNJLKKQslG2N+oWe5KM5:DkimTCPzYO5drslG2R5KM5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2668 icacls.exe

pid	process
2668	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4944 wrote to memory of 2668 4944 java.exe icacls.exe
PID 4944 wrote to memory of 2668 4944 java.exe icacls.exe

description	pid	process	target process
PID 4944 wrote to memory of 2668	4944	java.exe	icacls.exe
PID 4944 wrote to memory of 2668	4944	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\aac5d2ef572e27c2cf7fa45f364b29f6.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=2276,i,1205556100727695622,5044463180471657307,262144 --variations-seed-version /prefetch:8
1⤵
PID:1696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
d4e3128b3a58c359e91ebe2aed7689bf

SHA1
61a3f1b8c1aafe1e504ea169bae315e1a0289722

SHA256
f85ed9bebdd19d73f0fb75a252d92a3f16b41bdcf83cb7e74ed1671a2fed31ad

SHA512
14dde6ae93f46698d4d9cac6977e8bd84c991b8c1324f38df1000d8f249ae0b282c8efcc840323114d37fd3b456b9005cd00a8ac5c0d0119e89aea4dac857e3a

Download Submit
memory/4944-43-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-12-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-19-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-29-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-31-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-4-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-45-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-47-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-52-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-58-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-63-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-65-0x0000011BD9BF0000-0x0000011BDABF0000-memory.dmp

Filesize
16.0MB

Download
memory/4944-79-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download
memory/4944-84-0x0000011BD9BD0000-0x0000011BD9BD1000-memory.dmp

Filesize
4KB

Download