Analysis
- max time kernel
570s - max time network
443s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/03/2024, 22:08
General
- Target $TEMP/FeelingEyestrain-Launcher/u571/lib/ext/sunec.jar
- Size 38KB
- Sample240319-12pgdsha44
- SHA256 e2787698d746dc25c24d3be0fa751cea6267f68b4e972cfc3df4b4eac8046245
Score
7/10
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\$TEMP\FeelingEyestrain-Launcher\u571\lib\ext\sunec.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/1332-4-0x0000019E80000000-0x0000019E81000000-memory.dmp
memory/1332-12-0x0000019EFB080000-0x0000019EFB081000-memory.dmp
memory/1332-13-0x000002A225140000-0x000002A225150000-memory.dmp
memory/1332-29-0x000002A225240000-0x000002A225250000-memory.dmp
memory/1332-48-0x000002A22D5D0000-0x000002A22D5D1000-memory.dmp
memory/1332-47-0x000002A22D5D0000-0x000002A22D5D1000-memory.dmp
memory/1332-45-0x000002A22D5A0000-0x000002A22D5A1000-memory.dmp
memory/1332-49-0x000002A22D6E0000-0x000002A22D6E1000-memory.dmp