aa3c568c88329c4dd471492c0db25a6c299b4346562d63e850e3064902d86d69

Analysis

max time kernel
569s
max time network
452s
platform
windows10-2004_x64
resource
win10v2004-20240226-es
resource tags

arch:x64arch:x86image:win10v2004-20240226-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
11/03/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunchLegacy.jar
Size

23KB
MD5

b8e412180e698ecb3757a09c134191cc
SHA1

cb74a42d73f11c05a58d4bbe99666195741a6075
SHA256

149f50cc64844459322a8da8c62b3b97597d2302deb46a97be0279a8327382b8
SHA512

727d8b48a34ce083c26ec3b0622a23f0d15f44deea2e19af7d643a390dcd6d6b1ff2e08134d2a87175ca86fdb6436c1eb8ba5072cf52d1f674c779bf53a48cde
SSDEEP

384:MVVL1jDPUfYnONklSEaxh1jp8Buc6gd9rFXTbHD/8SkWlwP5:MVVP1lGh1j+Gy9RXTjD/8Sk2wP5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4844	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4844	3928	java.exe	91
PID 3928 wrote to memory of 4844	3928	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunchLegacy.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
0158d4c160ed05518790f04c4aa03785

SHA1
9e10bab7007687e9c5990dab86fc0427519ea38e

SHA256
db1956b639ac23bd29a0a049eb02441e80112fdaf7dc6d7f65056ce38b470e12

SHA512
97f4dd07470b1b5fa9a0cf6ddae9851770b0cc55fa663a196be9062bedbc69e1f6dec4d66471b422e63d13b168c86d247d1f59787212f94f5a2c595ebfc4c8da

Download Submit
memory/3928-4-0x000002215EB90000-0x000002215FB90000-memory.dmp

Filesize
16.0MB

Download
memory/3928-12-0x000002215D300000-0x000002215D301000-memory.dmp

Filesize
4KB

Download