63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Factura 39.jar
Size

209KB
MD5

2d5d4212065ca4cd30b1db90d381a709
SHA1

932d1a564bcbf46488d9797c8bfe4463390d0799
SHA256

63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59
SHA512

e8e39bbdf062a6097e99752c845ef8ccbe705bce5251c5a68905cfcfcf6139e722cacaaaab733a82b54323b651e5edff07cfff65b3103175f938dceb39cedc37
SSDEEP

6144:+Io8hJ0H//T5pbC8zylRdUVR36TduPPGVmyKb:+IxhuXnm8WGR36Ti6Kb

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4420	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4420	1068	java.exe	101
PID 1068 wrote to memory of 4420	1068	java.exe	101

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Factura 39.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1874b8089dc4913c15a626ad44476ebf

SHA1
898749a2ef7dc38478f9e8f068dc0a182f10aa30

SHA256
a0b465a33d4544e01f74fd3b7591cb515f4e98337d6114895a5d0c38ba60080b

SHA512
5d7d748bf995d2e45ff0122e71fb8128ba3556933e5bf93b18f17483c408b83e8eba533cf7c3be9dfb8b3a91c32b378a4cd37952426691817c9fa3aa58f3584f

Download Submit
memory/1068-2-0x00000200DBF20000-0x00000200DCF20000-memory.dmp

Filesize
16.0MB

Download
memory/1068-12-0x00000200DBF00000-0x00000200DBF01000-memory.dmp

Filesize
4KB

Download
memory/1068-23-0x00000200DBF00000-0x00000200DBF01000-memory.dmp

Filesize
4KB

Download
memory/1068-25-0x00000200DC190000-0x00000200DC1A0000-memory.dmp

Filesize
64KB

Download
memory/1068-27-0x00000200DBF20000-0x00000200DCF20000-memory.dmp

Filesize
16.0MB

Download
memory/1068-26-0x00000200DC1A0000-0x00000200DC1B0000-memory.dmp

Filesize
64KB

Download
memory/1068-28-0x00000200DC1B0000-0x00000200DC1C0000-memory.dmp

Filesize
64KB

Download
memory/1068-29-0x00000200DBF20000-0x00000200DCF20000-memory.dmp

Filesize
16.0MB

Download