fbff2ebba99bfa194af533852062c6d60831c7cc3801d4af980c329721484a28

Analysis

max time kernel
95s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Aristois-Free.jar
Size

6.6MB
MD5

4cad86ed173ff0dad198582d86bf62b6
SHA1

d25bd59b411076ccc1ed4b4daef78aef093a9d3d
SHA256

fbff2ebba99bfa194af533852062c6d60831c7cc3801d4af980c329721484a28
SHA512

e233c3ba1b3aeab0e286ad46e7ac4f34ae2207269c7a624bc29d90f14e6ff2dac4d74785414966569ab8da0b2d65d591eadd8884c1989976c361b5ff0c87aea2
SSDEEP

196608:N0EY4XwEff0cxykwL9g1leOnAU+1blTRLXKrC05:KYDf8FkHXAU8dJXKrb5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2684	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2684	3288	java.exe	89
PID 3288 wrote to memory of 2684	3288	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Aristois-Free.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1665e36c9257d2142300fc3aba1486bc

SHA1
a27672a5890ed7530c7c4b7236f39baaef857225

SHA256
1cbfab3d222a8b67694e0a4c6285b114b8154929d94c04a89232f45090cddbdf

SHA512
0da5f71b2e0601c93101425f71722a6593ee8935771836f57bb5135af8b83a918a6a7d0fe7783038e696bacfca7d16767de1859b4d5ce9b31335753511ac70f5

Download Submit
memory/3288-4-0x000002C28C850000-0x000002C28D850000-memory.dmp

Filesize
16.0MB

Download
memory/3288-15-0x000002C28C850000-0x000002C28D850000-memory.dmp

Filesize
16.0MB

Download
memory/3288-16-0x000002C28C850000-0x000002C28D850000-memory.dmp

Filesize
16.0MB

Download