aa3c568c88329c4dd471492c0db25a6c299b4346562d63e850e3064902d86d69

Analysis

max time kernel
199s
max time network
244s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunchLegacy.jar
Size

23KB
MD5

b8e412180e698ecb3757a09c134191cc
SHA1

cb74a42d73f11c05a58d4bbe99666195741a6075
SHA256

149f50cc64844459322a8da8c62b3b97597d2302deb46a97be0279a8327382b8
SHA512

727d8b48a34ce083c26ec3b0622a23f0d15f44deea2e19af7d643a390dcd6d6b1ff2e08134d2a87175ca86fdb6436c1eb8ba5072cf52d1f674c779bf53a48cde
SSDEEP

384:MVVL1jDPUfYnONklSEaxh1jp8Buc6gd9rFXTbHD/8SkWlwP5:MVVP1lGh1j+Gy9RXTjD/8Sk2wP5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
792	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 792	1092	java.exe	81
PID 1092 wrote to memory of 792	1092	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunchLegacy.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
47519d3a8833776bc4812ba3de6d5b9f

SHA1
9e6fce76ad21f52fba6da8ea76d8e6cd308038a8

SHA256
e3fc2461f4a6e69d30d98ea3404f85136c2df07aece884f20ae15b993cbd5ca3

SHA512
60445fad1dbab13d461bde4b8ce5782b0da525ece43d4dbef8117e63650e87b1c6c54f86510b48ab5f6324043ea7fbc925ee3ddf8f8000525d5fd8537dfae137

Download Submit
memory/1092-2-0x000001728EFF0000-0x000001728FFF0000-memory.dmp

Filesize
16.0MB

Download
memory/1092-12-0x000001728D740000-0x000001728D741000-memory.dmp

Filesize
4KB

Download