aa3c568c88329c4dd471492c0db25a6c299b4346562d63e850e3064902d86d69

Analysis

max time kernel
450s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11-03-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunch.jar
Size

13KB
MD5

53cc35c5bfd48a9b3e24fa3e4ed08782
SHA1

b65db5d8bffd2d568febbcdfcffa1d2484fbc478
SHA256

aaed45f1525c6a7d975499286a3734942ce55bcfbe02af9066c8b2aec65fbf22
SHA512

40ea51c9cdb9819a3ad14d42d8e80f263f97d4131d4c2332df7ce397d2a8df5caebdb8fd53a328cd2707a8014a6b5989380ff76186e167582d7317e7a75d73aa
SSDEEP

192:dIWK8KoDNpA0Tr5uKqlT4nlT1qV1ZdXRxXyZjjFufBeGnhXXP/Lf:GWK8/JpAUrTF1a1ZEWBeGxf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2396	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 2396	3152	java.exe	90
PID 3152 wrote to memory of 2396	3152	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
87fe436ac4af50863c002d2ee64704c8

SHA1
fd845076f3b47ec24b27701500e0fbbe10e46cab

SHA256
d0a2ac0aaef4833ac608929c012f6252cb5aaf3b1a65feee02ba77b7093823e5

SHA512
4558927521aecd7f0b55049b08e49259d3356218c67851332072d856fa2a60a0b4ef2e306dae5f599db23352a74772b3b15d27eb8956dd264271dd2c476df1c2

Download Submit
memory/3152-4-0x000001DF35680000-0x000001DF36680000-memory.dmp

Filesize
16.0MB

Download
memory/3152-12-0x000001DF33EB0000-0x000001DF33EB1000-memory.dmp

Filesize
4KB

Download
memory/3152-14-0x000001DF35680000-0x000001DF36680000-memory.dmp

Filesize
16.0MB

Download