Analysis
- max time kernel
142s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/03/2024, 08:32
General
- Target New order PI 24E8015.jar
- Size 182KB
- Sample240319-kfbemseh68
- SHA256 2c3c7bb834448fb264ee307b45877b28eacfb51c97c1733fb0f5f12e172a2d66
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Drops file in Program Files directory 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\New order PI 24E8015.jar"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/1952-39-0x00000273A03C0000-0x00000273A03D0000-memory.dmp
memory/1952-40-0x00000273A03D0000-0x00000273A03E0000-memory.dmp
memory/1952-18-0x00000273A0110000-0x00000273A1110000-memory.dmp
memory/1952-29-0x000002739E920000-0x000002739E921000-memory.dmp
memory/1952-31-0x00000273A0110000-0x00000273A1110000-memory.dmp
memory/1952-36-0x00000273A0390000-0x00000273A03A0000-memory.dmp
memory/1952-12-0x000002739E920000-0x000002739E921000-memory.dmp
memory/1952-37-0x00000273A03A0000-0x00000273A03B0000-memory.dmp
memory/1952-38-0x00000273A0400000-0x00000273A0410000-memory.dmp
memory/1952-4-0x00000273A0110000-0x00000273A1110000-memory.dmp
memory/1952-41-0x00000273A03E0000-0x00000273A03F0000-memory.dmp
memory/1952-42-0x00000273A03F0000-0x00000273A0400000-memory.dmp
memory/1952-43-0x00000273A0410000-0x00000273A0420000-memory.dmp
memory/1952-44-0x00000273A0430000-0x00000273A0440000-memory.dmp
memory/1952-45-0x00000273A0110000-0x00000273A1110000-memory.dmp
memory/1952-46-0x00000273A0110000-0x00000273A1110000-memory.dmp