fb77547cdc6e9a68a6c43edbffa436a0b54a8a5c06d1d003ae1f04e5cf54f085

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

common/lib/commons-el.jar
Size

109KB
MD5

7c98594df7c126f33688fa6d93169639
SHA1

1df2c042b3f2de0124750241ac6c886dbfa2cc2c
SHA256

0d67550ec0022b653453c759f063a643c2fe64bc48faa8b25f95a220e2a282e2
SHA512

006bb34a74baf740a9ab2b1218dbdbacdebf7ef8f9d756b69b3936257bd2d2977b0d7f8920377f04805298965246cd813bea6344557f76d77e9c0dc0fff91a5e
SSDEEP

3072:MVMDrWM6uEIA+gBvRKibeqcz2vaVGMk1+ijU1:VaM6uvA+uR1beRYaE3+gy

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4672	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 4672	1700	java.exe	91
PID 1700 wrote to memory of 4672	1700	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\common\lib\commons-el.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c110b1a7eef1d7fc569ae36c9a7c47b5

SHA1
1dd52520fe815ff3f6f4aa6db26ca6c8cfd9bbeb

SHA256
f093ecc45a4072f0cff0ac913a6bf1e54ba6a08f2a6aa981e20c6907a484c606

SHA512
ad34d1105b784b915932728787b679b9c90158d8f39f61580399ccc48d566c8ba447af70b9b0302288b32665a93cfa84e59de6e60a3cccc6fc487eca13b98860

Download Submit
memory/1700-4-0x0000019011780000-0x0000019012780000-memory.dmp

Filesize
16.0MB

Download
memory/1700-12-0x000001900FF50000-0x000001900FF51000-memory.dmp

Filesize
4KB

Download