55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
435s
max time network
445s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge-32.jar
Size 183KB
Sample240319-12pgdsha44
SHA256 af555dd438214dcd68d55ebddcc0a05bf47def0efd9920e3955d11cc2623628e
MD5 13794986ca59819f6af7bd70022d7f8f
SHA1 6c5609cd023eb001dc82f1e989d535cd7ad407ee
SHA512 2e3c4e76fd911eff5f6983d6d7fbb0f998e5fb0bfe11921a83ac9f19bfb0c28b157354f1ac790094c354845025ab42f5a921fddf2a780497431f3912d7d3e518
SSDEEP 3072:9Mxm+j7ZPrDuryFpqOv2xHamAIGiDZDo81qnI/vs7O04OvwFgBgvH6:ONduOJv29amxGiDtonI87aGBgva
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
960	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 960	1352	java.exe	92
PID 1352 wrote to memory of 960	1352	java.exe	92

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\ext\access-bridge-32.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-2-0x000002B9853F0000-0x000002B9863F0000-memory.dmp

Download

memory/1352-11-0x000002B983C10000-0x000002B983C11000-memory.dmp