d7d4ac1aff65e54fe1db6de6c66c340b3d94afe3e966ecae2fc7fe7f3bf05289

Analysis

max time kernel
447s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AbobaCoreServer.jar
Size 11.7MB
Sample240309-16jrpscc64
SHA256 d7d4ac1aff65e54fe1db6de6c66c340b3d94afe3e966ecae2fc7fe7f3bf05289
MD5 262d12ecbc40302554ebd40227cce652
SHA1 205e0087cca360aa7dbb7db67b9df724016292bc
SHA512 ebe5aff962df8fc921fd726ab9661cb9312f5097db9613ed6d81ef66f56756afe1d225a36e7901960f44062e63ea432125b9eb258406f73513f5788a266f904e
SSDEEP 196608:vO794UrJ4vfJXXApNeHBa7X7JqQ2XPATpz40RguZ0uRSm8MxNFkkNMooMIZln3:yMvfp8eh8LisVZgBu4mRLqkhaZl3
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1628	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4116	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1628	4116	java.exe	86
PID 4116 wrote to memory of 1628	4116	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\AbobaCoreServer.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 427aaff058bb78644627a3063fbaa4b1d547444ed08db07ff0a8ecd9dbe892da
MD5 4b256f90d820aefb06f9386166a3f8f9
SHA1 907ebc5e307124c66a6b4a03bfadedc6cd614666
SHA512 def09bf38852443bf7b204a78bbf56010572e839020c20e8ee9adddf18d4276196d439ce326a08182bbd3b1e588380be6760eb73ab76a6e32c5bb029864ce947
MD5 SHA1 SHA512

Submit Download

memory/4116-6-0x0000018A2D770000-0x0000018A2E770000-memory.dmp

Download

memory/4116-12-0x0000018A2D750000-0x0000018A2D751000-memory.dmp

Download

memory/4116-23-0x0000018A2D770000-0x0000018A2E770000-memory.dmp

Download

memory/4116-26-0x0000018A2D9F0000-0x0000018A2DA00000-memory.dmp

Download

memory/4116-27-0x0000018A2DA10000-0x0000018A2DA20000-memory.dmp

Download

memory/4116-25-0x0000018A2DA00000-0x0000018A2DA10000-memory.dmp

Download

memory/4116-29-0x0000018A2DA30000-0x0000018A2DA40000-memory.dmp

Download

memory/4116-28-0x0000018A2DA20000-0x0000018A2DA30000-memory.dmp

Download

memory/4116-30-0x0000018A2D770000-0x0000018A2E770000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads