8a0139670ac058d3c3c4fe64ba762b39e692f0cff7cc752ae438396ecd2ab0df

Analysis

max time kernel
136s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EUR-32608-Swift.jar
Size

209KB
MD5

bab2e737e8f87c387d069a4ae9af3a68
SHA1

2e936d38afa51c8adf496a3c58e431d1ca5cbf3f
SHA256

8a0139670ac058d3c3c4fe64ba762b39e692f0cff7cc752ae438396ecd2ab0df
SHA512

75cc6ee4731c75b9d40c08588f3b3a23d06d04b409ecea976b3008ed0f785e52e50e82fceef5f918fa31bd2050da9f413666d3f224b1fd8425982aec6545d118
SSDEEP

6144:7mF8ZJdHV/cwxa2UzyQRLaVIM0qOu2P7VmyKk:7mCZHFTlUfGIM0quBKk

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2212 icacls.exe

pid	process
2212	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1700 wrote to memory of 2212 1700 java.exe icacls.exe
PID 1700 wrote to memory of 2212 1700 java.exe icacls.exe

description	pid	process	target process
PID 1700 wrote to memory of 2212	1700	java.exe	icacls.exe
PID 1700 wrote to memory of 2212	1700	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\EUR-32608-Swift.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5204 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
1⤵
PID:4464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
61a33db12b696b7d136722e0eb5ff8e6

SHA1
41ed6f7d8aa558b5fe82122d6d74f4cb45f33c9f

SHA256
4579217d840f75ddc8e7f9a7899df71fd7ec2ae984eecde3b6a8cf00cdf09306

SHA512
5996d692fbb9d04c8349bec1aeb1b2a66cae183f9e01fcd36890137b4aeafb88cf05ba1c7b75abac96498affbc93a6c6c22a4b1bbb90c5935ab2a616e8aef5b3

Download Submit
memory/1700-35-0x0000018E99A40000-0x0000018E99A50000-memory.dmp

Filesize
64KB

Download
memory/1700-36-0x0000018E999F0000-0x0000018E99A00000-memory.dmp

Filesize
64KB

Download
memory/1700-18-0x0000018E97ED0000-0x0000018E97ED1000-memory.dmp

Filesize
4KB

Download
memory/1700-19-0x0000018E99750000-0x0000018E9A750000-memory.dmp

Filesize
16.0MB

Download
memory/1700-28-0x0000018E97ED0000-0x0000018E97ED1000-memory.dmp

Filesize
4KB

Download
memory/1700-32-0x0000018E99750000-0x0000018E9A750000-memory.dmp

Filesize
16.0MB

Download
memory/1700-12-0x0000018E97ED0000-0x0000018E97ED1000-memory.dmp

Filesize
4KB

Download
memory/1700-2-0x0000018E99750000-0x0000018E9A750000-memory.dmp

Filesize
16.0MB

Download
memory/1700-34-0x0000018E999D0000-0x0000018E999E0000-memory.dmp

Filesize
64KB

Download
memory/1700-37-0x0000018E99A00000-0x0000018E99A10000-memory.dmp

Filesize
64KB

Download
memory/1700-38-0x0000018E99A10000-0x0000018E99A20000-memory.dmp

Filesize
64KB

Download
memory/1700-40-0x0000018E99A30000-0x0000018E99A40000-memory.dmp

Filesize
64KB

Download
memory/1700-39-0x0000018E99A20000-0x0000018E99A30000-memory.dmp

Filesize
64KB

Download
memory/1700-41-0x0000018E99750000-0x0000018E9A750000-memory.dmp

Filesize
16.0MB

Download
memory/1700-42-0x0000018E99750000-0x0000018E9A750000-memory.dmp

Filesize
16.0MB

Download