21d2af8f6192380ebf0c91923df9a12a0d6b3c26f8478da73c8d8bf0d3963756

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2024 05:03

Target

21d2af8f6192380ebf0c91923df9a12a0d6b3c26f8478da73c8d8bf0d3963756.jar
Size

209KB
MD5

f9c912be352f38dce2c0e9743e9a46ba
SHA1

da2c05295eaff7e917a99b87c426d673f021a8ab
SHA256

21d2af8f6192380ebf0c91923df9a12a0d6b3c26f8478da73c8d8bf0d3963756
SHA512

14f7409a78cf4bd9f8b1943f24a9ecb591e5bc5e3eb25aa485f084c5881017f74faa3680ca83f4f732afbdd1361ee448d93ddc14a22858afcb490ed1a4bbb5fa
SSDEEP

6144:Ve/8hJTHV/SaxkiQzyORDGVWWUIYucPBVmyKT:VeUh1FjTQBaWWUIqTKT

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2076 icacls.exe

pid	process
2076	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4944 wrote to memory of 2076 4944 java.exe icacls.exe
PID 4944 wrote to memory of 2076 4944 java.exe icacls.exe

description	pid	process	target process
PID 4944 wrote to memory of 2076	4944	java.exe	icacls.exe
PID 4944 wrote to memory of 2076	4944	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
8f1ae04200b4ac2243a59bbec06fea83

SHA1
b11695586340b53af17cb81249d57c423bd2fb1b

SHA256
1cd7521ef6d5113f9e3b7e7c2a866a5cae689dc1e503c747f3a50b38f375c93d

SHA512
9479c215c23c62e54a7751537cf684f8e5877e079c64640fb10c6b697e94095e2d671b451248c85acbf36550409ba49935fdadb616271bed03ced2b25a736730

Download Submit
memory/4944-4-0x0000022E85990000-0x0000022E86990000-memory.dmp

Filesize
16.0MB

Download
memory/4944-12-0x0000022E85970000-0x0000022E85971000-memory.dmp

Filesize
4KB

Download
memory/4944-17-0x0000022E85990000-0x0000022E86990000-memory.dmp

Filesize
16.0MB

Download
memory/4944-20-0x0000022E85C10000-0x0000022E85C20000-memory.dmp

Filesize
64KB

Download
memory/4944-21-0x0000022E85990000-0x0000022E86990000-memory.dmp

Filesize
16.0MB

Download
memory/4944-22-0x0000022E85990000-0x0000022E86990000-memory.dmp

Filesize
16.0MB

Download