9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
87s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/dn-compiled-module.jar
Size

4.4MB
MD5

fa6ddfffe2f0b9d52a183aa45c3c2e2b
SHA1

0e3142d119f25037e69cd88a624709416cb6db54
SHA256

a805e6dc216db92067021450da10fbba1f9f70673a27e6edcc327764d4fcc4e6
SHA512

24d5883b4df570fa240ca2bf1241f4db2a62d3271673418c02ba690eb7cd31291d957d3b9abb521ce3f6bb30efea639859558332f9781baac0604f219cad819c
SSDEEP

98304:FagQg7riLcCa61MvR9+zMSX+X7m0l7y6GbWP0SCm/:FaghYn10RQOX7m0l7yyP0g/

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
280	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 280	2412	java.exe	82
PID 2412 wrote to memory of 280	2412	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\dn-compiled-module.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
2aa32e2fccf7b0f659f5128b1f4be5e1

SHA1
25cad30ce15cdf5691aae18216a7472ea33d04b8

SHA256
ef550c00ecd5cc794a295e401e806d22e2e4886ccd1df2b4a889fa78a7ed13aa

SHA512
51ea609bed15f572aada91843c082e37d16079f56089ede309010967f3243d0c7de281b8e7dbbc288185c7443b0126027436fec54935000a50cafdb90d42ef2a

Download Submit
memory/2412-4-0x0000017E4DC90000-0x0000017E4EC90000-memory.dmp

Filesize
16.0MB

Download
memory/2412-12-0x0000017E4DC70000-0x0000017E4DC71000-memory.dmp

Filesize
4KB

Download