8dd3b1a8146a6e777fa6b3e9f69071058aa73f756876c88f4c8e9be17e4a6483

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 07:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEW ORDER FOR MARCH.jar
Size 209KB
Sample240229-h3slbsab72
SHA256 8dd3b1a8146a6e777fa6b3e9f69071058aa73f756876c88f4c8e9be17e4a6483
MD5 288df8ebedd13b531e74c5f9ce730b2c
SHA1 5560f86aa3370b500a71837494da09ba7ba35516
SHA512 d017ebfdff1765759a66006785ed51024ef14b615090368aaff2c92e4b2bfcdc25e41ee3f146eecb51b724b50b7e5ec6d10584cea427e1a34bf6a86ff293364d
SSDEEP 6144:qEw8tJIH//nRBnmszyNRJAVdjifpuHPqVmyKd:qE5t6XbmsCudjifyeKd
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3856	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3856	4556	java.exe	91
PID 4556 wrote to memory of 3856	4556	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\NEW ORDER FOR MARCH.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 63d423ad01780e147bfbaae782a362c7955fc1ebdcd946af1e004e54852500ab
MD5 2dc32846546aa2fc96a567f9aa9d122e
SHA1 9b8ad7eb9792ec7e0c7bea299893c88a000c9596
SHA512 b309ddb2a96908352af990867f7b021268e9430448c0ed1ea990dd4e4abc232d530301db0deff4081936f84c81b1daa03fc2971059fe391310a56163a1fdc2e0
MD5 SHA1 SHA512

Submit Download

memory/4556-2-0x000001FC27720000-0x000001FC28720000-memory.dmp

Download

memory/4556-12-0x000001FC27700000-0x000001FC27701000-memory.dmp