Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2024 02:09
Behavioral task
behavioral1
Sample
2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c.jar
Resource
win10v2004-20240226-en
General
-
Target
2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c.jar
-
Size
178KB
-
MD5
6c4517de2d20c07218aacd670022ad00
-
SHA1
78d0f64fc0f4c5d6902762bbe514a7e1af8708d1
-
SHA256
2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c
-
SHA512
09a2171864e03ac9b2415fece8f3a7c7890480adde3418325231d4c965e227229dc997de9fa4071a3f8fe1040971e0aed852a1aa61a9e7753dd1ddb80e04caeb
-
SSDEEP
3072:iM9ZDCAIY6kppdX3UivK8V4Elu1n4M1vnYivy3LdCi0oUGGKp2iEYLpNj7bFDm:iMDLIk/dnU1x4M1PYivxATFLPbFq
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1820 wrote to memory of 3808 1820 java.exe icacls.exe PID 1820 wrote to memory of 3808 1820 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\2e2dea44f85ff4988ed8ddfcee37cc0e4ec9eadb941222eb8afae8a8358b892c.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1820-2-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-11-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-12-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-19-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-22-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-30-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-32-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-33-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-35-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-41-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-46-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-83-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-90-0x00000268682C0000-0x00000268682C1000-memory.dmpFilesize
4KB
-
memory/1820-101-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-111-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-121-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-133-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB
-
memory/1820-140-0x0000026869B80000-0x000002686AB80000-memory.dmpFilesize
16.0MB