ede6d3a6701e52285599fbb007f446572fbf8c7e1da1deb21c1f0526fd661e3f

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 01:39

Target

63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59.jar
Size

209KB
MD5

2d5d4212065ca4cd30b1db90d381a709
SHA1

932d1a564bcbf46488d9797c8bfe4463390d0799
SHA256

63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59
SHA512

e8e39bbdf062a6097e99752c845ef8ccbe705bce5251c5a68905cfcfcf6139e722cacaaaab733a82b54323b651e5edff07cfff65b3103175f938dceb39cedc37
SSDEEP

6144:+Io8hJ0H//T5pbC8zylRdUVR36TduPPGVmyKb:+IxhuXnm8WGR36Ti6Kb

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2952 icacls.exe

pid	process
2952	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3248 wrote to memory of 2952 3248 java.exe icacls.exe
PID 3248 wrote to memory of 2952 3248 java.exe icacls.exe

description	pid	process	target process
PID 3248 wrote to memory of 2952	3248	java.exe	icacls.exe
PID 3248 wrote to memory of 2952	3248	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\63c6996a03acda7db008bf6d1522b06efdff5fcdf7103b31767ebd47cee72a59.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2952

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
54529608b7966434285340d0097d15ef

SHA1
32756b1f73ad97f101f162ddaa7ae5ffad6f83e2

SHA256
b751e1e5af756552b76d122c832368b234fe4914350232ccf1b5ca93925a0205

SHA512
1df1973f1acda316ae680468d2b904e68c0651edb7cb8c5546f80d5b5b9730a6b111983a864f10d9b3993af1d07777c5d8daa17edb85867210c12bc6e3d99e90

Download Submit
memory/3248-4-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp

Filesize
16.0MB

Download
memory/3248-12-0x000001A82DBC0000-0x000001A82DBC1000-memory.dmp

Filesize
4KB

Download
memory/3248-16-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp

Filesize
16.0MB

Download
memory/3248-21-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp

Filesize
16.0MB

Download
memory/3248-23-0x000001A82DE60000-0x000001A82DE70000-memory.dmp

Filesize
64KB

Download
memory/3248-24-0x000001A82DE80000-0x000001A82DE90000-memory.dmp

Filesize
64KB

Download
memory/3248-25-0x000001A82DE90000-0x000001A82DEA0000-memory.dmp

Filesize
64KB

Download
memory/3248-26-0x000001A82DBE0000-0x000001A82EBE0000-memory.dmp

Filesize
16.0MB

Download