7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOA JAN 2024.jar
Size

182KB
MD5

4bb9375408befc34f88aa2ed81bd7d6a
SHA1

211ccad4ebf6678fd31145515d071abea0bf54d0
SHA256

7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7
SHA512

0ef4022e12a7a96b48d224b3ee740e97c1bb6e8033c632d025eaa246dcbb545be67aa1b36219d24dc1459a80f41802a4344ead55c994a424d1c4e777cebb2be3
SSDEEP

3072:IWwzAwQy6xRrY/Cr9SzamFe86HaZahwS1Xj57YOemqVcSxsZzVBr:fzwCTE/Cr9xnNX9cLaSx659

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1588 icacls.exe

pid	process
1588	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 392 wrote to memory of 1588 392 java.exe icacls.exe
PID 392 wrote to memory of 1588 392 java.exe icacls.exe

description	pid	process	target process
PID 392 wrote to memory of 1588	392	java.exe	icacls.exe
PID 392 wrote to memory of 1588	392	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\SOA JAN 2024.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1588

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
b18e75808f13c3a3f71f007038c68667

SHA1
fdf74dc2ca0b06a0abd13e4b64e06ae0f284e8fb

SHA256
d8027dc216c43ce174f823c206de209814ec0b214e931ae578c5c2b02774c96c

SHA512
1f42f66587312753bc9e0496cbb59fd1667acb26d591996bf0fa82944b5e9438763007a49064a9cf4b565eaa50509c737476805b3430665d03b7a4f2b90444ca

Download Submit
memory/392-35-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-12-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-18-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-29-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-33-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-4-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-41-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-48-0x000001BAD2980000-0x000001BAD3980000-memory.dmp

Filesize
16.0MB

Download
memory/392-53-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-58-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-68-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-69-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-74-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download
memory/392-77-0x000001BAD2960000-0x000001BAD2961000-memory.dmp

Filesize
4KB

Download