Analysis

  • max time kernel
    94s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-03-2024 01:39

General

  • Target

    63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59.jar

  • Size

    209KB

  • MD5

    2d5d4212065ca4cd30b1db90d381a709

  • SHA1

    932d1a564bcbf46488d9797c8bfe4463390d0799

  • SHA256

    63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59

  • SHA512

    e8e39bbdf062a6097e99752c845ef8ccbe705bce5251c5a68905cfcfcf6139e722cacaaaab733a82b54323b651e5edff07cfff65b3103175f938dceb39cedc37

  • SSDEEP

    6144:+Io8hJ0H//T5pbC8zylRdUVR36TduPPGVmyKb:+IxhuXnm8WGR36Ti6Kb

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2952

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
    Filesize

    46B

    MD5

    54529608b7966434285340d0097d15ef

    SHA1

    32756b1f73ad97f101f162ddaa7ae5ffad6f83e2

    SHA256

    b751e1e5af756552b76d122c832368b234fe4914350232ccf1b5ca93925a0205

    SHA512

    1df1973f1acda316ae680468d2b904e68c0651edb7cb8c5546f80d5b5b9730a6b111983a864f10d9b3993af1d07777c5d8daa17edb85867210c12bc6e3d99e90

  • memory/3248-4-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp
    Filesize

    16.0MB

  • memory/3248-12-0x000001A82DBC0000-0x000001A82DBC1000-memory.dmp
    Filesize

    4KB

  • memory/3248-16-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp
    Filesize

    16.0MB

  • memory/3248-21-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp
    Filesize

    16.0MB

  • memory/3248-23-0x000001A82DE60000-0x000001A82DE70000-memory.dmp
    Filesize

    64KB

  • memory/3248-24-0x000001A82DE80000-0x000001A82DE90000-memory.dmp
    Filesize

    64KB

  • memory/3248-25-0x000001A82DE90000-0x000001A82DEA0000-memory.dmp
    Filesize

    64KB

  • memory/3248-26-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp
    Filesize

    16.0MB