1fef89523cbb77aaa80a8abc968807e67a3891cae279d80bfe1722dd6f632957

Analysis

max time kernel
1794s
max time network
1804s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Darkness.jar
Size

10.0MB
MD5

889b06b5f00dfce6b9c31d249c665029
SHA1

be17fd10a39721523f21345c54b8148d0a5ddd27
SHA256

1fef89523cbb77aaa80a8abc968807e67a3891cae279d80bfe1722dd6f632957
SHA512

04564c0c09ea8ee563ba85b5c24b64ace4f32e37bc10920293cb169d9e13d27e3b07d9d55db720645f177016dd24971b62d0233c0bb06fca9b7806ef05a16a9a
SSDEEP

196608:y2+/sLJnDkqs39j8JoahXb7js0xD4SIaPqvCAwO:y2+/QJnIqs3xYocL7ArLF

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4200	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4200	4984	java.exe	97
PID 4984 wrote to memory of 4200	4984	java.exe	97

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Darkness.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4204 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6cb0eb992375cb40b294ab798a6333ad

SHA1
85d4e454634d951e8b14bf18476946b2945b8f03

SHA256
56169dde57ee3c1a340fb263bf13ef6c619e5a855b17e9f62fb73772ab9b3859

SHA512
459304577471a90251e82d513cd68b3a408f3b7f9c7506f52879df3402d4773e2372697a6f67d9e2ace6af43b877a256be7868ba0c94c84eaaa83009fb7d2da7

Download Submit
memory/4984-4-0x0000026EB02F0000-0x0000026EB12F0000-memory.dmp

Filesize
16.0MB

Download
memory/4984-12-0x0000026EAEA60000-0x0000026EAEA61000-memory.dmp

Filesize
4KB

Download