55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
447s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/dnsns.jar
Size 8KB
Sample240319-12pgdsha44
SHA256 36820223c5b9a225dc3ff7c1c3930bdb112f1d9aab2bee954ff1a1c1828e2c54
MD5 7fa7f97fa1cc0cc8acc37b9dae4464ae
SHA1 c143646a6dbe2ebdb1fbf69c09793e7f07dbc1f5
SHA512 ad9a0e358be7a765b4a554e6bbe35bdd61a52bcac9f21915d84c2a1929780150dfdcf0e43121d0e844082b1bb92873ed848acf9b38ff3c7d826e5d0f5d32c26c
SSDEEP 192:tX5jIgU7WbMCc0XmHTEIWB7EH+mqcEb+wYtvEmkbKdG:tXZU7WbMoWTFWBAH+BCrEmkh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4908	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4908	5044	java.exe	91
PID 5044 wrote to memory of 4908	5044	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\ext\dnsns.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 40524217a82f17133abf8f892d276e7d6374d60d46ae2fe9003d28f233ddb59b
MD5 c3e62e804a9399e312fa8550f15bc3bb
SHA1 d92fe1826c3805a7b52f13d9671bd5c77bc73bcb
SHA512 8610971fb90fc45821ad16e75416b2b6655c60a8fc145d23e10cc4c8d4908444901e435de9f1fedd21206522b4715afd9d1595bc650fb986c03ac9300c8c2968
MD5 SHA1 SHA512

Submit Download

memory/5044-4-0x0000016600000000-0x0000016601000000-memory.dmp

Download

memory/5044-11-0x000001667BB00000-0x000001667BB01000-memory.dmp

Download

memory/5044-13-0x0000016600000000-0x0000016601000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads