Overview

overview

7

Static

static

3

android-st...ws.exe

windows11-21h2-x64

7

$_32_/jre/...64.dll

windows11-21h2-x64

1

$_32_/jre/...64.dll

windows11-21h2-x64

1

$_32_/jre/...64.dll

windows11-21h2-x64

1

$_32_/jre/...ch.dll

windows11-21h2-x64

1

$_32_/jre/...wt.dll

windows11-21h2-x64

1

$_32_/jre/...em.dll

windows11-21h2-x64

1

$_32_/jre/...et.dll

windows11-21h2-x64

1

$_32_/jre/...er.dll

windows11-21h2-x64

1

$_32_/jre/...pe.dll

windows11-21h2-x64

1

$_32_/jre/...of.dll

windows11-21h2-x64

1

$_32_/jre/...nt.dll

windows11-21h2-x64

1

$_32_/jre/...sc.dll

windows11-21h2-x64

1

$_32_/jre/...11.dll

windows11-21h2-x64

1

$_32_/jre/...nt.dll

windows11-21h2-x64

1

$_32_/jre/...ch.exe

windows11-21h2-x64

1

$_32_/jre/...mi.exe

windows11-21h2-x64

1

$_32_/jre/...va.dll

windows11-21h2-x64

1

$_32_/jre/...va.exe

windows11-21h2-x64

1

$_32_/jre/...mo.dll

windows11-21h2-x64

1

$_32_/jre/...aw.exe

windows11-21h2-x64

1

$_32_/jre/...wt.dll

windows11-21h2-x64

1

$_32_/jre/...wp.dll

windows11-21h2-x64

1

$_32_/jre/...js.exe

windows11-21h2-x64

1

$_32_/jre/...li.dll

windows11-21h2-x64

1

$_32_/jre/...eg.dll

windows11-21h2-x64

1

$_32_/jre/...dt.dll

windows11-21h2-x64

1

$_32_/jre/...nd.dll

windows11-21h2-x64

1

$_32_/jre/...ds.dll

windows11-21h2-x64

1

$_32_/lib/....1.jar

windows11-21h2-x64

7

$_32_/lib/....3.jar

windows11-21h2-x64

7

$_32_/lib/....1.jar

windows11-21h2-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    186s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/03/2024, 20:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $_32_/lib/antlr4-runtime-4.1.jar

  • Size

    246KB

  • MD5

    670009558e7c71d9bbb92e329b45cc59

  • SHA1

    3f42a2396857e4b7d088a63ec265fd7817b14d7a

  • SHA256

    a80a47161618c3a1f318df924ba6ed26ff5420c8e2e806d50459171c8eb8d512

  • SHA512

    e46f8cade2cc00e5b37fab6f63b4688d054562a73b0201dcf93e2e0a115409258fc43b19e7e20d3bef0ff5daa8be32b44cdcd3cb82368b940fe175f1ccf1ccc8

  • SSDEEP

    6144:P3Lfnzk/3IxSolLWSYs6iLEs5hfACKUazyLHyXC:P7fzJL/6iLhojUazyLp

Score
7/10
discovery

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\$_32_\lib\antlr4-runtime-4.1.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4380
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1176

Network

  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    182.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.178.17.96.in-addr.arpa
    IN PTR
    Response
    182.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-182deploystaticakamaitechnologiescom
  • flag-us
    DNS
    182.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    182.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.243.31
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls
    2.0kB
     8.5kB
     19
    16
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls
    2.0kB
     8.5kB
     20
    17
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls
    94.3kB
     2.7MB
     1967
    1961
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls
    2.0kB
     8.5kB
     19
    16
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls
    2.0kB
     8.5kB
     19
    16
  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    349 B
     625 B
     5
    4

    DNS Request

    71.31.126.40.in-addr.arpa

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

    DNS Request

    31.243.111.52.in-addr.arpa

    DNS Request

    182.178.17.96.in-addr.arpa

    DNS Request

    182.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    224 B
     299 B
     3
    2

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.243.31

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
    Filesize

    46B

    MD5

    e79228261acf99bd8bef9981d908529c

    SHA1

    90b47824726901d781941c4a4704d3a275de290d

    SHA256

    74b013990a2e7a545e0ce63c038fa14f6006574a2c4c3de6837ed2416286c47a

    SHA512

    c633dcf0fe2bc934c2c6a7d06d8680ddab630ef702ad954aa4a00540c75c318ac4aebc3f7883d0acbaf5119646a14378d4537e23a5c46045fab07a8ad68f9806

    Download Submit

  • memory/4380-8-0x000002BCE3270000-0x000002BCE4270000-memory.dmp

    Filesize

    16.0MB

    Download

  • memory/4380-12-0x000002BCE3250000-0x000002BCE3251000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4380-13-0x000002BCE3270000-0x000002BCE4270000-memory.dmp

    Filesize

    16.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.