79098273db492173009ed9fdd408224f010bb6222a09f4f93fcc6de5bf324acc

Analysis

max time kernel
101s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 17:31

Target

PROFORMA INVOICE.jar
Size

209KB
MD5

b6211e0aea888d1d1502812dc2a6e26c
SHA1

8f0e44f2128b2451dd681f7c807ecdba1283f0c4
SHA256

79098273db492173009ed9fdd408224f010bb6222a09f4f93fcc6de5bf324acc
SHA512

0021749654fe4d56163fda85a975e7335820becaa8889dec59a7b35d3faa97dc67f0516b77257a7881c45b5c4cc66829ba8b4d830cf3c0160af79ddda460770b
SSDEEP

6144:J2j85JHHl/6C1kOQzyaRfiVO6w0UuwPdVmyKw:J2Y59VHXQVqO6w02PKw

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1288 icacls.exe

pid	process
1288	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3120 wrote to memory of 1288 3120 java.exe icacls.exe
PID 3120 wrote to memory of 1288 3120 java.exe icacls.exe

description	pid	process	target process
PID 3120 wrote to memory of 1288	3120	java.exe	icacls.exe
PID 3120 wrote to memory of 1288	3120	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1288

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
c673674ffcd279c8924686b80bce514a

SHA1
4f9bb600a0c549cde412f9a1abd72dad83f4b39a

SHA256
66b93d643ac17faeeeae75da076852a209fe04e3b130481b82ed865ac3160fb2

SHA512
524d6ce936240463e8e1f19f022f3a5d161dddc4194aab7c7f34839f777b0ff8cc1df9fb258067df5cc3b6ebc95896dcc5aa16f60084a4b21487168288a8d9b2

Download Submit
memory/3120-4-0x0000025480000000-0x0000025481000000-memory.dmp

Filesize
16.0MB

Download