Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-03-2024 12:03
Behavioral task
behavioral1
Sample
d375b26e07150dc37dae2ce7d22a586b.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d375b26e07150dc37dae2ce7d22a586b.jar
Resource
win10v2004-20240226-en
General
-
Target
d375b26e07150dc37dae2ce7d22a586b.jar
-
Size
102KB
-
MD5
d375b26e07150dc37dae2ce7d22a586b
-
SHA1
8d4ec9d1b48c5cd2ffaeae674c8e93b489a5c171
-
SHA256
56f0a10c33da16a1d597d2772bca21ae3e39cc179cf31eef3fa623480580bb61
-
SHA512
6b388b840e70b988345be952efdce79d830934abb49dcbc6060441a0cd58014de4cd4ed19743adce77ee7af0133fe7db00d10a5d578754fb8d714e9f8925b3ec
-
SSDEEP
1536:cjSW+gbZj1hXLp8tmGiwvzk//zNpPShwbRWNcRcqrdHc4CSshc/6yN6:cjSW+QZjHX6tgGadAqp8nSsnyM
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1908 wrote to memory of 3256 1908 java.exe icacls.exe PID 1908 wrote to memory of 3256 1908 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\d375b26e07150dc37dae2ce7d22a586b.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5eb6f01303ce08d03503087f64bbf25ce
SHA15ef20d7d28b16779d07cd891327b1b83cfb53f92
SHA256d99461aead1f74aec5c1627bbacc8d53da7381aed59d0c7ed85d6a80902f7637
SHA512fa29c959fab746b07988c7c1577c922415e52f5a0dc91e7b41d787a1995fa740e84d3fe6344f86ecf25a1b4f8c995b3396ed3b1fdc1d6480bb45ab17fc649b77
-
memory/1908-4-0x0000027169610000-0x000002716A610000-memory.dmpFilesize
16.0MB
-
memory/1908-16-0x0000027169610000-0x000002716A610000-memory.dmpFilesize
16.0MB
-
memory/1908-18-0x0000027169890000-0x00000271698A0000-memory.dmpFilesize
64KB
-
memory/1908-19-0x00000271698A0000-0x00000271698B0000-memory.dmpFilesize
64KB
-
memory/1908-20-0x0000027169610000-0x000002716A610000-memory.dmpFilesize
16.0MB