a7ba5f8d3e9e8affa35bac6ec34df381c6095976694d4460a8389d52c964f33c

Resubmissions

28/02/2024, 13:15

240228-qg979acd7v 7

28/02/2024, 11:41

240228-nttpxsag3v 7

28/02/2024, 10:38

240228-mplyvahe97 7

Analysis

max time kernel
135s
max time network
172s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
28/02/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/jrt-fs.jar
Size

104KB
MD5

65e610432d1b25381007a10c1a1e6892
SHA1

283d633d17d9699a01b7788dc897a9d54bf03271
SHA256

54aef3a5d8edd97314baa0f6132564db498bae38481eb6ee9c64346f70dbe93e
SHA512

6fdadf72c2c76e4260f7f6005a0240f1c57448bf282fc4b92a41897f9606220cce300787afafb35a316b26101c422c1c1f2f2fe7ce2c2f4f4f4ec50c60c9389f
SSDEEP

1536:doB0yv2bbvKO+WLGGLZbotK7+3FoTho/WoUtkOd0t+WojK4qDUe88TN:uB0kIc3uZigh6TAd0/ojKrDvzx

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5044	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 5044	4668	java.exe	77
PID 4668 wrote to memory of 5044	4668	java.exe	77

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\jrt-fs.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d2e60cc59573596880fa5ec6457a9edf

SHA1
612899719551c4dffbd95ad891a32486de29b93e

SHA256
988aae5b466b5e03dfd442061683da9f58addb225b3f101447357c8becb0ac95

SHA512
54d1ea90b3ea9222949d4282aaa0f073c746f203f1fa2a9c78be94de7a06559063ac9ed419bd4118e0befd47d1dd8fb383f5bceedb64a6d217cd799c8ea61701

Download Submit
memory/4668-4-0x000001B4D0050000-0x000001B4D1050000-memory.dmp

Filesize
16.0MB

Download
memory/4668-12-0x000001B4CE760000-0x000001B4CE761000-memory.dmp

Filesize
4KB

Download