fb77547cdc6e9a68a6c43edbffa436a0b54a8a5c06d1d003ae1f04e5cf54f085

Analysis

max time kernel
143s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/commons-logging-api-1.1.1.jar
Size

51KB
MD5

4ec8e1d8171e578b3151e898311a8710
SHA1

da6e46d20241ccc81edb3525a241114b95177fd7
SHA256

be41aab0157c3dd8346440d31550890953c032469d02805f55c3b8c5749bb1db
SHA512

2053ba78ebda49b6229394b8a3a1bdd0913e7d29c6028c853b75f2f9f21b4d1ceb6cb0af25c3513914aab2915b08b088ad91704c77d3d7056f979cf5cf24b167
SSDEEP

768:Girg27IA9Q0CSAJh70q9ENKHZ8LwyEOu1wICfXcMpQHBSSfqKeRtjMw84O84ki:/5vh2V0q9EsH+wyEpaIGXNrSiK79Tz

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1688	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1688	764	java.exe	91
PID 764 wrote to memory of 1688	764	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\bin\commons-logging-api-1.1.1.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c86e1847fc6f82dfdc38ed4d0b5ec395

SHA1
d396807afa19b9f1d50bcc61b80514ce6d94cbe1

SHA256
dd34512c00d55d4b47d1407a917bcca0425bfbf8cbdc3aa2be81db4bbfe370f0

SHA512
97ca87aa3d3c5a1b110588609cfdf66dfb02057f63ca90cbd391d4c209be04e79f1f3b3c71d615ce163f7a66629a594c910d7a5ad8d69e33496529f255ecde75

Download Submit
memory/764-4-0x0000026C91EC0000-0x0000026C92EC0000-memory.dmp

Filesize
16.0MB

Download
memory/764-11-0x0000026C91EA0000-0x0000026C91EA1000-memory.dmp

Filesize
4KB

Download