c496a406536d17e5f8ab08b94b8fa187af12cba398ee9a92cd9ef000d356f904

Analysis

max time kernel
126s
max time network
437s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/03/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_32_/lib/asm-5.0.3.jar
Size

51KB
MD5

ccebee99fb8cdd50e1967680a2eac0ba
SHA1

dcc2193db20e19e1feca8b1240dbbc4e190824fa
SHA256

71c4f78e437b8fdcd9cc0dfd2abea8c089eb677005a6a5cff320206cc52b46cc
SHA512

d35bda1ecf09753572fd0582d2e79f07bbd563ca936d1238690d4bedaf57c68512580c49aba75d03fda41db27b84fc5cb276b8cfd990167ccc9dbecbc69f388d
SSDEEP

1536:tA7yhw44dwmgi3EOqSC1JwZ3oVnDaQM26rqebvrN+:O74uBxXoqInDax26Wqvx+

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4856	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4856	2576	java.exe	76
PID 2576 wrote to memory of 4856	2576	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\$_32_\lib\asm-5.0.3.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
e47ec5ccad1fd4c6a8990206640c4708

SHA1
3357c328b82614d134c1c38ead921dfeb98eb4f8

SHA256
e683268a3a5766de976621c553c46faebaa166439ba6a03027229aef5585b9ac

SHA512
a53c8bea5b18d0b64729fb4e175d62fd4f578e09054f78f6b4a3e20ccf4c015763550c019a3c620afdb84d81aa4a9959fd6441012ecb901f4b65bd1af4cfd648

Download Submit
memory/2576-4-0x000002520AC00000-0x000002520BC00000-memory.dmp

Filesize
16.0MB

Download
memory/2576-11-0x0000025209310000-0x0000025209311000-memory.dmp

Filesize
4KB

Download
memory/2576-13-0x000002520AC00000-0x000002520BC00000-memory.dmp

Filesize
16.0MB

Download