841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 02:30

Target

841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec.jar
Size

209KB
MD5

70c7e80f047ed2162aff41a46b770dd8
SHA1

6d02a11dba0bb998c5581bb4bec3ab2dcd02c646
SHA256

841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec
SHA512

6b875f1e6afeb46b413fef3fe34625b6e2ba83b2b9043a53eeeac53aa0694362a59b281e7b14bb3ab0630b199d208d56e1c9016d6f9e8e081d8ed5ff69c3c165
SSDEEP

6144:S8A8lJAHv//RZfeEzydRZ4V9DCHJuPPCVmyKx:S8plSHzWEi29DCH6mKx

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1104 icacls.exe

pid	process
1104	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1752 wrote to memory of 1104 1752 java.exe icacls.exe
PID 1752 wrote to memory of 1104 1752 java.exe icacls.exe

description	pid	process	target process
PID 1752 wrote to memory of 1104	1752	java.exe	icacls.exe
PID 1752 wrote to memory of 1104	1752	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\841594fe3e8400fc4162f73b0b1393c4903d0225f25c73277ba2ec442b8095ec.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1104

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4a0402b68875483aadf577fc3e5ca3c8

SHA1
6ebc3dbf6acd68899f2eae6a78e0383af1581284

SHA256
a3e1cfdb462157e4e817fba319f8e98e85398041ebde81e3ed230c09dbdbbc5d

SHA512
cf815503e1a1d6a52326bccf52a02b25f3a766c896591ac5b1b0169c7b759589ecf6ca0c81d4cf32bda6c030a1c31df14d8126a585bf24d97a2649351f58ec9e

Download Submit
memory/1752-2-0x000001DFDD780000-0x000001DFDE780000-memory.dmp

Filesize
16.0MB

Download
memory/1752-15-0x000001DFDBF10000-0x000001DFDBF11000-memory.dmp

Filesize
4KB

Download
memory/1752-18-0x000001DFDDA00000-0x000001DFDDA10000-memory.dmp

Filesize
64KB

Download
memory/1752-19-0x000001DFDD780000-0x000001DFDE780000-memory.dmp

Filesize
16.0MB

Download
memory/1752-20-0x000001DFDD780000-0x000001DFDE780000-memory.dmp

Filesize
16.0MB

Download