fb77547cdc6e9a68a6c43edbffa436a0b54a8a5c06d1d003ae1f04e5cf54f085

Analysis

max time kernel
139s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

common/lib/jsp-api.jar
Size

48KB
MD5

3dd2e132c12ba675a3d7d6c9391b76e1
SHA1

5bd9a27553beb5451b594fffc70b1419be0f254b
SHA256

63ffcaa7fb48ad92bebbc08d8b73f0dc7a86d29906ed976dee11baa4066b9969
SHA512

ab62ab017abc6f29938fe4c580ccd9a82b9bed0f65c6063b92162bd046bca0ca350635cecec09159915e4865b3f45a612258f3cc9dc9ebe02e9d9128c4a56194
SSDEEP

768:zNkuEvE9ueQW2TzjjmWSFB0smz+yJl8ChMcK+woj0eedlt9I/FYQeiFF7p6KianE:SVznmWSslxMcXNeqWQ4KiojxO

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1504	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1504	4928	java.exe	101
PID 4928 wrote to memory of 1504	4928	java.exe	101

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\common\lib\jsp-api.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-2-0x000001BEE5780000-0x000001BEE6780000-memory.dmp

Filesize
16.0MB

Download
memory/4928-11-0x000001BEE3F60000-0x000001BEE3F61000-memory.dmp

Filesize
4KB

Download