52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 08:20

Target

TEKLIF-ISTEME.jar
Size

64KB
MD5

42e3509850681ccff160078d391581b9
SHA1

be3a6011ad989c9328c72cf318f06cbfa499cd82
SHA256

52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111
SHA512

0628f0a7c9b2b2a73103ef2c6be0d1a40f6c658a6418d324ca0e7fad24a3367de6df01a237516865e03b36bb47bbb0eb2a9cb71a509e6c3dc48ab70d96d9671d
SSDEEP

1536:s/LvDzcVMHH4xoLPM4qxtOPLfqA09xtRd3W4Ur:sLD1HYxGWtOPLfos4Ur

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1816 icacls.exe

pid	process
1816	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4700 wrote to memory of 1816 4700 java.exe icacls.exe
PID 4700 wrote to memory of 1816 4700 java.exe icacls.exe

description	pid	process	target process
PID 4700 wrote to memory of 1816	4700	java.exe	icacls.exe
PID 4700 wrote to memory of 1816	4700	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
1065dc926a5142c95595ff996d5bd579

SHA1
9bd91e793b0a311dd25f4360502860c1a27ca4b4

SHA256
33539d172c2237665ede2bcf4e2c301ee97a26e4fc87763adcc542fa846822fb

SHA512
31e6ff52d012dac36ab326bf44e0758729661b6a033c6f5435288fda0b32a8670dac87cf3f04a07c1ca5a04e660c58184ca45deb2f3b09ebfadd5ca2d3638542

Download Submit
memory/4700-4-0x000001EB94DB0000-0x000001EB95DB0000-memory.dmp

Filesize
16.0MB

Download
memory/4700-12-0x000001EB935C0000-0x000001EB935C1000-memory.dmp

Filesize
4KB

Download
memory/4700-19-0x000001EB94DB0000-0x000001EB95DB0000-memory.dmp

Filesize
16.0MB

Download
memory/4700-21-0x000001EB94DB0000-0x000001EB95DB0000-memory.dmp

Filesize
16.0MB

Download
memory/4700-23-0x000001EB95030000-0x000001EB95040000-memory.dmp

Filesize
64KB

Download
memory/4700-24-0x000001EB95050000-0x000001EB95060000-memory.dmp

Filesize
64KB

Download