55626f87358dc713199e31869307ffcc9e38a08d7f204b5feb0181f17ea47519

Analysis

max time kernel
589s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$TEMP/FeelingEyestrain-Launcher/u571/lib/ext/localedata.jar
Size 1.1MB
Sample240319-12pgdsha44
SHA256 321d646ad29a5b180ca98bb49e81c2c732523b7e5145a3c568766cec06b2b1cd
MD5 24857ad811ceda70bd0f087fd28b5b6e
SHA1 707305eb10b1464d40bdeabade77b80b984a621a
SHA512 a10a340bdb2de2d0d14ed804f04313d1d4cbd64ef0513a9e54b7fa95ffb05f2123c9095a4b2bffa4ddf3adea9a67e978d26d115a8f5677ae1bd0ee67c416fa5a
SSDEEP 12288:qLvFVMHxMyEg7+dYmx0nqEdgq2C942bjAHcOveMdDLtHHicwqJM5SznKMWKdk/H2:cF9rYmxQ5tOcOdFwqSYzn0DfYHs4jOBK
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3384	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3384	1944	java.exe	95
PID 1944 wrote to memory of 3384	1944	java.exe	95

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\ext\localedata.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
1⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2260,i,11662483365823245381,11064702639240765741,262144 --variations-seed-version /prefetch:8
1⤵
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-4-0x0000011584FC0000-0x0000011585FC0000-memory.dmp

Download

memory/1944-11-0x00000115837B0000-0x00000115837B1000-memory.dmp