a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 02:17

Target

a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead.jar
Size

109KB
MD5

90e0fb5c6cb86b7b12129108077f03b9
SHA1

26f78fce02a512e1c14715cc5f76a98cab26282f
SHA256

a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead
SHA512

fcd2dc4bd1d65f4d92d4e482a9166df74a897f09cbfc0d4100fd65e3a6102951085b0554041b51b211327149ee74c99e703cdeb7c98497c3955a44cd8cc20233
SSDEEP

3072:JsOq/Sv/eNHBeBy8BZMCOZ6mdbx9jHTuctPXZWyROqzyNw:Lq6v/e1gBy88Cy6wbx9vuctPUtqzyK

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1824 icacls.exe

pid	process
1824	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1208 wrote to memory of 1824 1208 java.exe icacls.exe
PID 1208 wrote to memory of 1824 1208 java.exe icacls.exe

description	pid	process	target process
PID 1208 wrote to memory of 1824	1208	java.exe	icacls.exe
PID 1208 wrote to memory of 1824	1208	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1824

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
385d8c298af177f1db919c3cfad0ac98

SHA1
eddfa2c596a2770edb1acd4ca338915e185de8a7

SHA256
11366c6f89bedca90f7b2fcb200adacdc6a357d411f97f22f842c59bd21dd77e

SHA512
bcdef8f92c38739bf098abb50ea88a6a935c0ec670cf28ba47e1501871e75eb8626be85015818ccd165b6ee81e70f73d45b2fea5d632d1d257120642669b8110

Download Submit
memory/1208-2-0x00000183A76B0000-0x00000183A86B0000-memory.dmp

Filesize
16.0MB

Download
memory/1208-12-0x00000183A7690000-0x00000183A7691000-memory.dmp

Filesize
4KB

Download
memory/1208-17-0x00000183A76B0000-0x00000183A86B0000-memory.dmp

Filesize
16.0MB

Download
memory/1208-24-0x00000183A76B0000-0x00000183A86B0000-memory.dmp

Filesize
16.0MB

Download
memory/1208-26-0x00000183A7930000-0x00000183A7940000-memory.dmp

Filesize
64KB

Download
memory/1208-27-0x00000183A7950000-0x00000183A7960000-memory.dmp

Filesize
64KB

Download
memory/1208-28-0x00000183A7960000-0x00000183A7970000-memory.dmp

Filesize
64KB

Download
memory/1208-29-0x00000183A7970000-0x00000183A7980000-memory.dmp

Filesize
64KB

Download
memory/1208-30-0x00000183A76B0000-0x00000183A86B0000-memory.dmp

Filesize
16.0MB

Download