9f000e49c75142dd94ed9688dea77505afd31642bc9e953a69a5d2863156b0e0

Analysis

max time kernel
85s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lib/gson.jar
Size

226KB
MD5

5134a2350f58890ffb9db0b40047195d
SHA1

751f548c85fa49f330cecbb1875893f971b33c4e
SHA256

2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32
SHA512

c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a
SSDEEP

3072:2DiL6hR+wm60gqZjJhqo2M04r7bv1XMrMxw1rl1rwj+Bmd6dYBmkW1eIjEmFdbl6:bq0jSi2Qi1B1Cay6dYBUwmPxLe3

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4940	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 4940	1020	java.exe	82
PID 1020 wrote to memory of 4940	1020	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\gson.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
06c9dccf7466557fd971b76f36ca0a56

SHA1
55a6d55fa3b1f9e9e88803ac7f9b5a08f445cc86

SHA256
ada0fe267f5f1e5ee9304e7a3413c7a0537ce1fdb563b80f5f038163c1dad9a3

SHA512
ecd78d4187f9b524395d53405fd5cbd5656fb2d4292f435c58e259bafcda4d3ecb66fbb56012f4fb828d9abc07b130acbed9e7a059bb27fafab782a42cbd6a9c

Download Submit
memory/1020-5-0x000001EEE88C0000-0x000001EEE98C0000-memory.dmp

Filesize
16.0MB

Download
memory/1020-11-0x000001EEE70C0000-0x000001EEE70C1000-memory.dmp

Filesize
4KB

Download
memory/1020-13-0x000001EEE88C0000-0x000001EEE98C0000-memory.dmp

Filesize
16.0MB

Download