Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-03-2024 03:57
Behavioral task
behavioral1
Sample
7d1fed6f7a55e3208f33a3e084161f300403d1ad482ed4e04fca355c4807feec.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7d1fed6f7a55e3208f33a3e084161f300403d1ad482ed4e04fca355c4807feec.jar
Resource
win10v2004-20240226-en
General
-
Target
7d1fed6f7a55e3208f33a3e084161f300403d1ad482ed4e04fca355c4807feec.jar
-
Size
209KB
-
MD5
c340008b05ff34748fbf0ff15c52faaa
-
SHA1
77886d206e6986724c0b98ed62eff26e04285363
-
SHA256
7d1fed6f7a55e3208f33a3e084161f300403d1ad482ed4e04fca355c4807feec
-
SHA512
13a3e34fbd701743d533d897785c5ccb1220ddf36c360e0cf9fd35d32f715a77e39c07c085182b0f548d1627618859b111f144309627802047609a2df687157b
-
SSDEEP
6144:L2V8BJFHt/MQhSWszygRLaVIkMCmu2PjVmyKa:L2yB39bVs3GIkMCmZKa
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 2796 wrote to memory of 4756 2796 java.exe icacls.exe PID 2796 wrote to memory of 4756 2796 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\7d1fed6f7a55e3208f33a3e084161f300403d1ad482ed4e04fca355c4807feec.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD53d24d0572a20bf99fd8f934d5769bb7b
SHA1e81384be9b8c5c5aa862d057b40eba0a75113b19
SHA256dd33e9f327aec240a3c391d25ed8984ade5991b920ec3a8e0d9f1f5e2d8b9061
SHA512528f4e8a681530fbcd8fe5472a6e0cdc5b5cae85034040d7edc027773792f58c6051b0fb121b9dd2d4f8925fe0aea0da21a445d3094fe3e09c72d94b7fcdf437
-
memory/2796-79-0x0000023E873D0000-0x0000023E873D1000-memory.dmpFilesize
4KB
-
memory/2796-132-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-17-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-23-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-30-0x0000023E873D0000-0x0000023E873D1000-memory.dmpFilesize
4KB
-
memory/2796-36-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-41-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-90-0x0000023E873D0000-0x0000023E873D1000-memory.dmpFilesize
4KB
-
memory/2796-147-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-13-0x0000023E873D0000-0x0000023E873D1000-memory.dmpFilesize
4KB
-
memory/2796-46-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-107-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-113-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-117-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-122-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-126-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-128-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-4-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-141-0x0000023E88D60000-0x0000023E89D60000-memory.dmpFilesize
16.0MB
-
memory/2796-63-0x0000023E873D0000-0x0000023E873D1000-memory.dmpFilesize
4KB