63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-03-2024 11:31

Target

Attachment.jar
Size

209KB
MD5

2d5d4212065ca4cd30b1db90d381a709
SHA1

932d1a564bcbf46488d9797c8bfe4463390d0799
SHA256

63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59
SHA512

e8e39bbdf062a6097e99752c845ef8ccbe705bce5251c5a68905cfcfcf6139e722cacaaaab733a82b54323b651e5edff07cfff65b3103175f938dceb39cedc37
SSDEEP

6144:+Io8hJ0H//T5pbC8zylRdUVR36TduPPGVmyKb:+IxhuXnm8WGR36Ti6Kb

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1592 icacls.exe

pid	process
1592	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1492 wrote to memory of 1592 1492 java.exe icacls.exe
PID 1492 wrote to memory of 1592 1492 java.exe icacls.exe

description	pid	process	target process
PID 1492 wrote to memory of 1592	1492	java.exe	icacls.exe
PID 1492 wrote to memory of 1592	1492	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Attachment.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1592

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f744e10c42e94d93f1dea356d24cc01d

SHA1
99074416e6888494c6a2cf9c570d854d5a148adc

SHA256
848123f69973de158d51360b8750b35499633f2472e5c97ad439c6161dc0e256

SHA512
af18433f02c35f95ac6a12f2100b05281a3bdbd307d9cf3ee8b6ed891892ddf4667f448ca5b7d985aedbc065914a79bc380d2b9c2da10756e48815b4f7591eba

Download Submit
memory/1492-4-0x0000025780000000-0x0000025781000000-memory.dmp

Filesize
16.0MB

Download
memory/1492-12-0x00000257FACB0000-0x00000257FACB1000-memory.dmp

Filesize
4KB

Download