55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
447s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/access-bridge.jar
Size 183KB
Sample240319-12pgdsha44
SHA256 1f0966ebd65544669395e9f490a3d397dcf122d5261566734bb422c68cfe64b8
MD5 82c16750374d5cca5fdaa9434baf8143
SHA1 9b49f07bfb6f4ae73eb9b2fadcae46e02e31f023
SHA512 12a32fbe2a0a824ec33bd6d0a22066c0cb74d13eebc16622ffe420cd48b4eb5878c981384debe30285d6231b3224e5cd2380c22d8c18624e52e5c74b62221661
SSDEEP 3072:aMxm+j7ZPrDuryFpqOv2xHamAIGiDZDo81qnI/vs7O04OvwFgBPlHl:nNduOJv29amxGiDtonI87aGBPlF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4112	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4112	2024	java.exe	85
PID 2024 wrote to memory of 4112	2024	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\ext\access-bridge.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 43f181053d7a72af7792721edbecdc8812245cf894d4921106b22723be1a87d0
MD5 3db865a2b3947ed402511e3014ef40ec
SHA1 f0166992103b7e6fb87b15ac94869afa1aa58107
SHA512 b514a94668e58a30a35a6519507e0a381b7d7f0d00bd0ee3b58880e3d35bb82ec19e24f644c5d28ce13786640138cd5c9e662ada7cb661e454020c231a4b2f0d
MD5 SHA1 SHA512

Submit Download

memory/2024-4-0x0000021E3C8B0000-0x0000021E3D8B0000-memory.dmp

Download

memory/2024-12-0x0000021E3B080000-0x0000021E3B081000-memory.dmp