e7674068583ee9a44a19fbbf9f08281b53cb2b8a1533552421ea74f5829e5efd

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

swift copy.jar
Size

182KB
MD5

f8121ad15a5e9951490c23860585d3e2
SHA1

1e9c3d47a320448ef1061e11e3cae1b493bf9d83
SHA256

e7674068583ee9a44a19fbbf9f08281b53cb2b8a1533552421ea74f5829e5efd
SHA512

2ad3c451360a295702c94d316dbc9b402b73b946c024180e676daeb061caf1751dcc28a012e1907a4f733054121460ee193e6307f66db80de8d6aa41886cd4f5
SSDEEP

3072:UeQPYwQe6BFfMX2b9SvCe9eo6HaZyhkS9Xj5HgmematQuxsxztXp:/3wO70X2b99rZX9crmuxSR5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4876 icacls.exe

pid	process
4876	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4520 wrote to memory of 4876 4520 java.exe icacls.exe
PID 4520 wrote to memory of 4876 4520 java.exe icacls.exe

description	pid	process	target process
PID 4520 wrote to memory of 4876	4520	java.exe	icacls.exe
PID 4520 wrote to memory of 4876	4520	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\swift copy.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4876

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
7ef0b32677a57f39e408d636a43fa929

SHA1
22aec96260af3e815f19b8a45bcfbb191ce82432

SHA256
b67cbd05b6e200e9cf85f2402b60034c5b4affebeca46ed2a1775be5b063e50a

SHA512
4753a7ddbb5e9165216a8543fcdfd293c2a17e9c9a7c37733a5e6f1e822ac1f058afba95fa64ce013882cf28caf6e481dd74b3dadb6e8fc4912fcf6f38e88ad7

Download Submit
memory/4520-55-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-26-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-83-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-108-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-105-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-30-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-32-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-35-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-38-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-4-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-16-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-12-0x0000018CDAE30000-0x0000018CDAE31000-memory.dmp

Filesize
4KB

Download
memory/4520-24-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-113-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-117-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-128-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-132-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-135-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-138-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-142-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download
memory/4520-156-0x0000018CDC660000-0x0000018CDD660000-memory.dmp

Filesize
16.0MB

Download