a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DOC65346578090000.jar
Size

109KB
MD5

90e0fb5c6cb86b7b12129108077f03b9
SHA1

26f78fce02a512e1c14715cc5f76a98cab26282f
SHA256

a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead
SHA512

fcd2dc4bd1d65f4d92d4e482a9166df74a897f09cbfc0d4100fd65e3a6102951085b0554041b51b211327149ee74c99e703cdeb7c98497c3955a44cd8cc20233
SSDEEP

3072:JsOq/Sv/eNHBeBy8BZMCOZ6mdbx9jHTuctPXZWyROqzyNw:Lq6v/e1gBy88Cy6wbx9vuctPUtqzyK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4916 icacls.exe

pid	process
4916	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3044 wrote to memory of 4916 3044 java.exe icacls.exe
PID 3044 wrote to memory of 4916 3044 java.exe icacls.exe

description	pid	process	target process
PID 3044 wrote to memory of 4916	3044	java.exe	icacls.exe
PID 3044 wrote to memory of 4916	3044	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DOC65346578090000.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1ba6f3313d4deb0080c063e9d4042f8e

SHA1
2d859e709f51ca41bca63ecee5bf77c7d0c18309

SHA256
db3797c2fab92413a8fd946753e046b61c227f59fb351123305660b9291e8c29

SHA512
fc9dd52d2156e86f2068b38b8734d23c715eb2e0043f42d6aca0c70d8a1d3797448d9fc54404c1cd6fe335c1c4188527d3fac4f3f12f0bb5d6c5e7d7a9e0b729

Download Submit
memory/3044-47-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download
memory/3044-33-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download
memory/3044-49-0x000001EE016E0000-0x000001EE016F0000-memory.dmp

Filesize
64KB

Download
memory/3044-51-0x000001EE01700000-0x000001EE01710000-memory.dmp

Filesize
64KB

Download
memory/3044-50-0x000001EE016F0000-0x000001EE01700000-memory.dmp

Filesize
64KB

Download
memory/3044-44-0x000001EE01690000-0x000001EE016A0000-memory.dmp

Filesize
64KB

Download
memory/3044-45-0x000001EE01710000-0x000001EE01720000-memory.dmp

Filesize
64KB

Download
memory/3044-46-0x000001EE016C0000-0x000001EE016D0000-memory.dmp

Filesize
64KB

Download
memory/3044-48-0x000001EE016D0000-0x000001EE016E0000-memory.dmp

Filesize
64KB

Download
memory/3044-2-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download
memory/3044-21-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download
memory/3044-12-0x000001EE7EF80000-0x000001EE7EF81000-memory.dmp

Filesize
4KB

Download
memory/3044-29-0x000001EE7EF80000-0x000001EE7EF81000-memory.dmp

Filesize
4KB

Download
memory/3044-52-0x000001EE01720000-0x000001EE01730000-memory.dmp

Filesize
64KB

Download
memory/3044-53-0x000001EE01740000-0x000001EE01750000-memory.dmp

Filesize
64KB

Download
memory/3044-54-0x000001EE01750000-0x000001EE01760000-memory.dmp

Filesize
64KB

Download
memory/3044-55-0x000001EE01760000-0x000001EE01770000-memory.dmp

Filesize
64KB

Download
memory/3044-56-0x000001EE01770000-0x000001EE01780000-memory.dmp

Filesize
64KB

Download
memory/3044-57-0x000001EE01780000-0x000001EE01790000-memory.dmp

Filesize
64KB

Download
memory/3044-58-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download
memory/3044-59-0x000001EE01410000-0x000001EE02410000-memory.dmp

Filesize
16.0MB

Download