fb77547cdc6e9a68a6c43edbffa436a0b54a8a5c06d1d003ae1f04e5cf54f085

Analysis

max time kernel
88s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

common/lib/jasper-runtime.jar
Size

75KB
MD5

0ac00f2f8b7c3c50357548c02481d4eb
SHA1

8290337493dac3768f14713ed5ee4214b3b15aad
SHA256

26a4e3520ad3a708edf220738a799fdfea692c6be7fd7494a98589098fb20247
SHA512

d7bffc05ecf364577c8fdbe369af41411792434c9ef7f51b9d04ef3e5e215ef2241ae1ab615081378a70728dcff4e4808dfdc42fd57774e302f223fe8ea25f71
SSDEEP

1536:UrrERMAgYaMaivVxDaoRouCy067ahmAnN0dURAMO+IjxGzm7NsO/qtozy:U/mMAgYhain9Qy0phmAWSRfsjAzm9qtj

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3116	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3116	3536	java.exe	92
PID 3536 wrote to memory of 3116	3536	java.exe	92

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\common\lib\jasper-runtime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4ed9e0ffa3f2a46f7b8e5a5a9182784a

SHA1
ab3e28121b896ee9bd7946bd143d7249fc29496a

SHA256
8500e621c73ef130abf8d6fdc7e76b1da8d27bfb55d38b41bb16ede63300c3e1

SHA512
22b0148b3f5221af52c6e255b5e9d6036ccf623fd898532af3698848854aedcbe40aca9954acb7eb346c3349afda47216a20cdae648508ae4913615e474aa76c

Download Submit
memory/3536-3-0x0000023B00000000-0x0000023B01000000-memory.dmp

Filesize
16.0MB

Download
memory/3536-11-0x0000023B72E90000-0x0000023B72E91000-memory.dmp

Filesize
4KB

Download
memory/3536-13-0x0000023B00000000-0x0000023B01000000-memory.dmp

Filesize
16.0MB

Download