aa3c568c88329c4dd471492c0db25a6c299b4346562d63e850e3064902d86d69

Analysis

max time kernel
144s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
09-03-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunch.jar
Size

13KB
MD5

53cc35c5bfd48a9b3e24fa3e4ed08782
SHA1

b65db5d8bffd2d568febbcdfcffa1d2484fbc478
SHA256

aaed45f1525c6a7d975499286a3734942ce55bcfbe02af9066c8b2aec65fbf22
SHA512

40ea51c9cdb9819a3ad14d42d8e80f263f97d4131d4c2332df7ce397d2a8df5caebdb8fd53a328cd2707a8014a6b5989380ff76186e167582d7317e7a75d73aa
SSDEEP

192:dIWK8KoDNpA0Tr5uKqlT4nlT1qV1ZdXRxXyZjjFufBeGnhXXP/Lf:GWK8/JpAUrTF1a1ZEWBeGxf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4752 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1676 wrote to memory of 4752 1676 java.exe icacls.exe
PID 1676 wrote to memory of 4752 1676 java.exe icacls.exe

pid	process
4752	icacls.exe

description	pid	process	target process
PID 1676 wrote to memory of 4752	1676	java.exe	icacls.exe
PID 1676 wrote to memory of 4752	1676	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
9eabbdb1603c39f953e4cb73a8293b35

SHA1
1cb9abc9818cb9c2173383d9578caf63d465ab2b

SHA256
afb3a818df5fe90b7ccd6cb98c228dada8ecd8a687032cc8345f79ae7d22c063

SHA512
312871b778af1221bf357d77f924c83c601ef8bb759281aac625ec5d7884b65cad287eac3efcdf8d34a2c829539080e0cfb1a7a0d787de923c90d0607eb04248

Download Submit
memory/1676-4-0x000001DF00000000-0x000001DF01000000-memory.dmp

Filesize
16.0MB

Download
memory/1676-12-0x000001DF7A880000-0x000001DF7A881000-memory.dmp

Filesize
4KB

Download
memory/1676-14-0x000001DF00000000-0x000001DF01000000-memory.dmp

Filesize
16.0MB

Download