Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 02:26
Behavioral task
behavioral1
Sample
64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3.jar
Resource
win10v2004-20240226-en
General
-
Target
64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3.jar
-
Size
178KB
-
MD5
0f0274c22f9479969a5c7991a81d7233
-
SHA1
4eda9e68ffc9158532fe53d7939c45db671192cc
-
SHA256
64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3
-
SHA512
dbb6fd8b6cf2e86d540e7275f8040ffe003bf7866bfe86623b9ae402229fae598fe7e59533b8f099bcce97fbde09aea7728783879eb5f2a92664a3a4034615a5
-
SSDEEP
3072:/+ySyCvkYdkYAdyztiaKSr4ppewn4Z1SnYikytLdnipAUGGepviEY+pNjcMWBd:/+t7kxddQtad4Z1GYik3cAF+gMW7
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 3140 wrote to memory of 1092 3140 java.exe icacls.exe PID 3140 wrote to memory of 1092 3140 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\64e8cb522a3a4664791c27512d94a911bc2fbcbae09b625976ff8ac6809819d3.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD506d5b49134c1d0cd95bb504f0646e00b
SHA19293bd6d29235962ac2fcca682a60965aaea0c1a
SHA25692900369e7124d56d02808b5caa36f2346dd1517879869687319c766a35db141
SHA512316848ecfb2b5bc7da7ff813beaae23117d099b5a596b550597e2f43d6cbc44b2d4c2039744c3540ab37f5119ede5117b447a2fd12b04d245d42f098071b6bee
-
memory/3140-4-0x00000173AAEC0000-0x00000173ABEC0000-memory.dmpFilesize
16.0MB
-
memory/3140-12-0x00000173AAEA0000-0x00000173AAEA1000-memory.dmpFilesize
4KB
-
memory/3140-20-0x00000173AAEC0000-0x00000173ABEC0000-memory.dmpFilesize
16.0MB
-
memory/3140-30-0x00000173AAEC0000-0x00000173ABEC0000-memory.dmpFilesize
16.0MB
-
memory/3140-34-0x00000173AAEA0000-0x00000173AAEA1000-memory.dmpFilesize
4KB
-
memory/3140-46-0x00000173AAEC0000-0x00000173ABEC0000-memory.dmpFilesize
16.0MB
-
memory/3140-54-0x00000173AAEC0000-0x00000173ABEC0000-memory.dmpFilesize
16.0MB
-
memory/3140-64-0x00000173AAEA0000-0x00000173AAEA1000-memory.dmpFilesize
4KB
-
memory/3140-74-0x00000173AAEA0000-0x00000173AAEA1000-memory.dmpFilesize
4KB