Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 02:38
Behavioral task
behavioral1
Sample
bf9f710ba1787558944c14a51c3caab8.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bf9f710ba1787558944c14a51c3caab8.jar
Resource
win10v2004-20240226-en
General
-
Target
bf9f710ba1787558944c14a51c3caab8.jar
-
Size
107KB
-
MD5
bf9f710ba1787558944c14a51c3caab8
-
SHA1
8ae1f0e795b1aadc692964ac6ee27127fb7d6644
-
SHA256
d12c23844f090115e9ab57ad9d53fefe49dbbe05a1766551d6b0dd916451965e
-
SHA512
6b9d951521628e0fa58158e29d9dbeb511c053824575815c943d06f5d98375b7333be4f4cedcd4d864714735a8f9633bd960a58c0f177d7391de272e6a61ccf5
-
SSDEEP
1536:JbnFYRwaRs91zJuDt6IulM3p6crzdUKW3CwxC5MQAssDgRmAWYGfq6gbyoLGgFo:kG91zaL3Usxe3S5AssDYvGi6g2hD
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 4208 wrote to memory of 4152 4208 java.exe icacls.exe PID 4208 wrote to memory of 4152 4208 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\bf9f710ba1787558944c14a51c3caab8.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD560ce901427565f71fb06c82a5471e202
SHA1f0c6b493292a148f02e2b339e401a719cdb7c1bb
SHA256ff63c1474d7306ddd7d88ac0d4f155697698ed1b70d24fc79f1a881b984b4138
SHA512caee867e7d1c1d66c25427e1c2cc19895923ef93023c8cb2663e06d4c42d08fe339d6d5f9b81aabeb3fb62987850a9018a7f33dc2d89577d3f698def670004c5
-
memory/4208-6-0x0000020E51F20000-0x0000020E52F20000-memory.dmpFilesize
16.0MB
-
memory/4208-12-0x0000020E51F00000-0x0000020E51F01000-memory.dmpFilesize
4KB
-
memory/4208-18-0x0000020E51F20000-0x0000020E52F20000-memory.dmpFilesize
16.0MB
-
memory/4208-27-0x0000020E521A0000-0x0000020E521B0000-memory.dmpFilesize
64KB
-
memory/4208-26-0x0000020E51F20000-0x0000020E52F20000-memory.dmpFilesize
16.0MB
-
memory/4208-28-0x0000020E521C0000-0x0000020E521D0000-memory.dmpFilesize
64KB
-
memory/4208-29-0x0000020E521D0000-0x0000020E521E0000-memory.dmpFilesize
64KB
-
memory/4208-30-0x0000020E521E0000-0x0000020E521F0000-memory.dmpFilesize
64KB
-
memory/4208-31-0x0000020E51F20000-0x0000020E52F20000-memory.dmpFilesize
16.0MB