18c9eb77a8395a0f4c8c5d1ffefd3155e142fabb4b7516678e56f56704bd257e

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79098273db492173009ed9fdd408224f010bb6222a09f4f93fcc6de5bf324acc.jar
Size

209KB
MD5

b6211e0aea888d1d1502812dc2a6e26c
SHA1

8f0e44f2128b2451dd681f7c807ecdba1283f0c4
SHA256

79098273db492173009ed9fdd408224f010bb6222a09f4f93fcc6de5bf324acc
SHA512

0021749654fe4d56163fda85a975e7335820becaa8889dec59a7b35d3faa97dc67f0516b77257a7881c45b5c4cc66829ba8b4d830cf3c0160af79ddda460770b
SSDEEP

6144:J2j85JHHl/6C1kOQzyaRfiVO6w0UuwPdVmyKw:J2Y59VHXQVqO6w02PKw

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3680 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 5024 wrote to memory of 3680 5024 java.exe icacls.exe
PID 5024 wrote to memory of 3680 5024 java.exe icacls.exe

pid	process
3680	icacls.exe

description	pid	process	target process
PID 5024 wrote to memory of 3680	5024	java.exe	icacls.exe
PID 5024 wrote to memory of 3680	5024	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\79098273db492173009ed9fdd408224f010bb6222a09f4f93fcc6de5bf324acc.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5504 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5496 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5340 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=3960 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:1
1⤵
PID:3188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-2-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-11-0x000001BE84C10000-0x000001BE84C11000-memory.dmp

Filesize
4KB

Download
memory/5024-24-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-26-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-30-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-33-0x000001BE84C10000-0x000001BE84C11000-memory.dmp

Filesize
4KB

Download
memory/5024-35-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-39-0x000001BE84C10000-0x000001BE84C11000-memory.dmp

Filesize
4KB

Download
memory/5024-74-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-75-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-83-0x000001BE84C10000-0x000001BE84C11000-memory.dmp

Filesize
4KB

Download
memory/5024-87-0x000001BE84C10000-0x000001BE84C11000-memory.dmp

Filesize
4KB

Download
memory/5024-100-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-109-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-127-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-133-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-148-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-160-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download
memory/5024-167-0x000001BE84C30000-0x000001BE85C30000-memory.dmp

Filesize
16.0MB

Download