fb77547cdc6e9a68a6c43edbffa436a0b54a8a5c06d1d003ae1f04e5cf54f085

Analysis

max time kernel
156s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/bootstrap.jar
Size

23KB
MD5

4695e92650075f0d6f22ea7e813af7e2
SHA1

6d32a52080aefa7c9a90da70244daea3285b67ee
SHA256

ca66111a57b25b2dc5824977a68424345fe5a20c009d49489cec66cdef9599c7
SHA512

20f217cf6f129cc66a9cba33af2efda97d513d309f9fadfc28912dd4a0f7094d4542092c3b03600e1d0d592d98976c467a39cd6df5a50ec4a845da3ba4016f8f
SSDEEP

384:ROVGfulnyQ+Vg1enh1hFmr5ECJ7wQpzQLfnAcaNbE5oClRMdqbO/V1PZ7Bvo/baz:ROVGf4nyQ+VYSVmBUQSLfnAcVDMdaOHZ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3316	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3316	4288	java.exe	102
PID 4288 wrote to memory of 3316	4288	java.exe	102

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\bootstrap.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4fe7bcae7bee07a91d5df1ea8f7199a5

SHA1
e20d46a4b1b5db0a0c101227735ad97527c6411a

SHA256
26f3809cef1cd34187a9d0912767e0f40fbfbe1742278b557d5b74f2b66da6e5

SHA512
88fee65416cfe4f2709fa115389ef10aa0a3009568267e9948390ad9968e014a909ee53cc907eed7ad4a77b9dc526fe4364b7f807502cb11c6a1f51081871752

Download Submit
memory/4288-2-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-12-0x000001DEACCE0000-0x000001DEACCE1000-memory.dmp

Filesize
4KB

Download
memory/4288-25-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-26-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-28-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-29-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-33-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download
memory/4288-38-0x000001DEAE340000-0x000001DEAF340000-memory.dmp

Filesize
16.0MB

Download