b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/libraries/java/PackXZExtract.jar
Size

120KB
MD5

cf8aa6c50804b3d2448b316b1cd24b17
SHA1

a69190724b20156dd17504162fbe771309415b73
SHA256

a847432bdf7da12571bbd5bda3b11ca3664675d1ff9baad5abd59b2d0689fa93
SHA512

d897b843cf6d138885ffbcddcd53c84819bca0a1ac9de46334601d67fa9ba05d6b857b396a67b6f92e9f7745fce3f1a0402b76e4b31bd56d3cd36c339ac1e07c
SSDEEP

3072:4KKXNfoEU3hN7cOGhjVjRGreZHupS4uHAtS8X:bKip377EXGHqHAwG

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4396	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 4396	428	java.exe	91
PID 428 wrote to memory of 4396	428	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\PackXZExtract.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
fd16d7b9bde0d625d840e65168fe76f9

SHA1
6d7a1047ea29ae5ec0cd1fc801826b077c8e048a

SHA256
d03ae1010767a30e1f6af5c7c5ba6b3c7348b1fab820494517e14b021806fd1d

SHA512
335c89a569c66f670ae2b0b87e9539af9e8293b581b6878ffdea7d98960093218e4cad51c714732c019bde3f818571839ce9a440c8aa7890bf5e0ba5035e8aee

Download Submit
memory/428-4-0x000002D953D90000-0x000002D954D90000-memory.dmp

Filesize
16.0MB

Download
memory/428-12-0x000002D953D70000-0x000002D953D71000-memory.dmp

Filesize
4KB

Download