113e817b7fc2240adf7c1cb807663ebbc1df541ed07c2f19d1a0ebab0db3f265

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead.jar
Size

109KB
MD5

90e0fb5c6cb86b7b12129108077f03b9
SHA1

26f78fce02a512e1c14715cc5f76a98cab26282f
SHA256

a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead
SHA512

fcd2dc4bd1d65f4d92d4e482a9166df74a897f09cbfc0d4100fd65e3a6102951085b0554041b51b211327149ee74c99e703cdeb7c98497c3955a44cd8cc20233
SSDEEP

3072:JsOq/Sv/eNHBeBy8BZMCOZ6mdbx9jHTuctPXZWyROqzyNw:Lq6v/e1gBy88Cy6wbx9vuctPUtqzyK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4308 icacls.exe

pid	process
4308	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3944 wrote to memory of 4308 3944 java.exe icacls.exe
PID 3944 wrote to memory of 4308 3944 java.exe icacls.exe

description	pid	process	target process
PID 3944 wrote to memory of 4308	3944	java.exe	icacls.exe
PID 3944 wrote to memory of 4308	3944	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a95313d60a72e884da0432039645f13e0cdf14fc05e24e78785a4e2de8931ead.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
19d781d94b47ddc2968e8436ad50063c

SHA1
24483bbc37364dbb50776fdce7be8a481986cee7

SHA256
b49e6cce317b6bee1915216e56eef6f79635911f2ba7fb29624a4af730024059

SHA512
37454117e1fb5aa8c3df21de7e96bb7a542a2f21fdf92e978ac9c9bd7ae56ce8c06ec8e26254aaf74c4b9f579714362487de5ff66c4c12ce25898723e4cbbf88

Download Submit
memory/3944-48-0x000002BD9B600000-0x000002BD9B610000-memory.dmp

Filesize
64KB

Download
memory/3944-19-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-50-0x000002BD9B550000-0x000002BD9B560000-memory.dmp

Filesize
64KB

Download
memory/3944-29-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-31-0x000002BD99C40000-0x000002BD99C41000-memory.dmp

Filesize
4KB

Download
memory/3944-33-0x000002BD99C40000-0x000002BD99C41000-memory.dmp

Filesize
4KB

Download
memory/3944-44-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-46-0x000002BD9B510000-0x000002BD9B520000-memory.dmp

Filesize
64KB

Download
memory/3944-51-0x000002BD9B570000-0x000002BD9B580000-memory.dmp

Filesize
64KB

Download
memory/3944-4-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-60-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-12-0x000002BD99C40000-0x000002BD99C41000-memory.dmp

Filesize
4KB

Download
memory/3944-47-0x000002BD9B590000-0x000002BD9B5A0000-memory.dmp

Filesize
64KB

Download
memory/3944-52-0x000002BD9B580000-0x000002BD9B590000-memory.dmp

Filesize
64KB

Download
memory/3944-53-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-54-0x000002BD9B5A0000-0x000002BD9B5B0000-memory.dmp

Filesize
64KB

Download
memory/3944-55-0x000002BD9B5B0000-0x000002BD9B5C0000-memory.dmp

Filesize
64KB

Download
memory/3944-57-0x000002BD9B5E0000-0x000002BD9B5F0000-memory.dmp

Filesize
64KB

Download
memory/3944-56-0x000002BD9B5D0000-0x000002BD9B5E0000-memory.dmp

Filesize
64KB

Download
memory/3944-58-0x000002BD9B290000-0x000002BD9C290000-memory.dmp

Filesize
16.0MB

Download
memory/3944-59-0x000002BD9B5F0000-0x000002BD9B600000-memory.dmp

Filesize
64KB

Download
memory/3944-49-0x000002BD9B540000-0x000002BD9B550000-memory.dmp

Filesize
64KB

Download