f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO#0015871.jar
Size

163KB
MD5

a22184b2e7c7673c4c37bc5c08c6f011
SHA1

1af5a401e967998de2733bee4da5878bb0caf30d
SHA256

f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20
SHA512

4d28fdc16b86283a4d7ffb1b2dc943b632f12163aabbd69aa2af9d2bb14c914eaf50f08233a3f4d499e3cc3076a3679018e085b8201eb9ecc8c0742552a4a334
SSDEEP

3072:5KqqJ8EPFDwH4E2A52puSdBGb//BtrbMg+Og5yG8C65F9y/9E2MGDBv:54nJww0QuSzuXBtrgieeDElVND5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1196 icacls.exe

pid	process
1196	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 952 wrote to memory of 1196 952 java.exe icacls.exe
PID 952 wrote to memory of 1196 952 java.exe icacls.exe

description	pid	process	target process
PID 952 wrote to memory of 1196	952	java.exe	icacls.exe
PID 952 wrote to memory of 1196	952	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PO#0015871.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
a7529c0d28abc6986b4a5e6277049d0e

SHA1
cb34ec399986ba37b0db4e466f67a034e44d3646

SHA256
fd579b95b86508f6609fcb8cc79af9736e26e8d9b18e44e3569679278c861ec9

SHA512
f3ce360ff4118b570847742bcc973a96ec4fd7a19b33925186e69796e25236f212a6c98c03dcbb0823b753bb7202488544ff3622d3f38a4b6c9539178d83611b

Download Submit
memory/952-36-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-12-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-19-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-25-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-31-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-4-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-40-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-48-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-55-0x000002640A6F0000-0x000002640B6F0000-memory.dmp

Filesize
16.0MB

Download
memory/952-74-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-81-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-87-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-99-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download
memory/952-106-0x0000026408E20000-0x0000026408E21000-memory.dmp

Filesize
4KB

Download