a87af64dfea31dd2e08ae33b9a595b37ed4fa1511f195caa498ee9d51199528c

Resubmissions

01/03/2024, 13:10

240301-qel3msgd9810

01/03/2024, 13:06

240301-qb3afsgd7610

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4.jar
Size 479KB
Sample240301-qel3msgd98
SHA256 a87af64dfea31dd2e08ae33b9a595b37ed4fa1511f195caa498ee9d51199528c
MD5 2bc77cbaca6f8ac04a0e4d698cf5133a
SHA1 34252120652ba3a20588aa557337538d21e5ed88
SHA512 fc14834e588ac87ea762a181ac12d1a59ca0fc60edb20ac1323493543760b641a6d9951c1bc3e04c66cf3692a284b793eff2cf9d8ab4050fb58d543780c24563
SSDEEP 12288:K3s/A44AVZhW33fUnE6J5Ur5pxogQNUhIK/0c2qnAf:K30ASVZ0nfs5U1sS7B2qng
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1900	icacls.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 1900	4180	java.exe	97
PID 4180 wrote to memory of 1900	4180	java.exe	97
PID 4180 wrote to memory of 4488	4180	java.exe	100
PID 4180 wrote to memory of 4488	4180	java.exe	100

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1900
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.13417099256495895664424379614687542.class
  2⤵
  - Drops file in Program Files directory
  PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a87aebaf9ae9f6d64f9207ce40610866438deb32b868b58e4944e4c337131f2f
MD5 54f085d5a3157f7c1a91ef61efc10928
SHA1 fa502a9cf504eec3742dd355e3a7bfcef51133f1
SHA512 2fa7aa69061052e800b37eef8ebeacaa14c62ebe60f3d297dc9396a68d4959ddc44a27771e2d14a1d1616f97d13bb5db958289963965e5572857980a395823cc
MD5 SHA1 SHA512

Submit Download

_0.13417099256495895664424379614687542.class

Path C:\Users\Admin\AppData\Local\Temp\_0.13417099256495895664424379614687542.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_2397ee06-28fe-4eaa-8777-f7014368c353

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\83aa4cc77f591dfc2374580bbd95f6ba_2397ee06-28fe-4eaa-8777-f7014368c353
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/4180-61-0x0000021ADCBE0000-0x0000021ADCBF0000-memory.dmp

Download

memory/4180-62-0x0000021ADCC00000-0x0000021ADCC10000-memory.dmp

Download

memory/4180-65-0x0000021ADC960000-0x0000021ADD960000-memory.dmp

Download

memory/4180-64-0x0000021ADC960000-0x0000021ADD960000-memory.dmp

Download

memory/4180-12-0x0000021ADAF60000-0x0000021ADAF61000-memory.dmp

Download

memory/4180-52-0x0000021ADC960000-0x0000021ADD960000-memory.dmp

Download

memory/4180-63-0x0000021ADCC20000-0x0000021ADCC30000-memory.dmp

Download

memory/4180-2-0x0000021ADC960000-0x0000021ADD960000-memory.dmp

Download

memory/4180-58-0x0000021ADC960000-0x0000021ADD960000-memory.dmp

Download

memory/4488-57-0x000002B197390000-0x000002B1973A0000-memory.dmp

Download

memory/4488-30-0x000002B197120000-0x000002B198120000-memory.dmp

Download

memory/4488-55-0x000002B1973A0000-0x000002B1973B0000-memory.dmp

Download

memory/4488-46-0x000002B195900000-0x000002B195901000-memory.dmp

Download

memory/4488-31-0x000002B195900000-0x000002B195901000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads