e7674068583ee9a44a19fbbf9f08281b53cb2b8a1533552421ea74f5829e5efd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 17:12

Target

swift copy.jar
Size

182KB
MD5

f8121ad15a5e9951490c23860585d3e2
SHA1

1e9c3d47a320448ef1061e11e3cae1b493bf9d83
SHA256

e7674068583ee9a44a19fbbf9f08281b53cb2b8a1533552421ea74f5829e5efd
SHA512

2ad3c451360a295702c94d316dbc9b402b73b946c024180e676daeb061caf1751dcc28a012e1907a4f733054121460ee193e6307f66db80de8d6aa41886cd4f5
SSDEEP

3072:UeQPYwQe6BFfMX2b9SvCe9eo6HaZyhkS9Xj5HgmematQuxsxztXp:/3wO70X2b99rZX9crmuxSR5

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4964 icacls.exe

pid	process
4964	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3304 wrote to memory of 4964 3304 java.exe icacls.exe
PID 3304 wrote to memory of 4964 3304 java.exe icacls.exe

description	pid	process	target process
PID 3304 wrote to memory of 4964	3304	java.exe	icacls.exe
PID 3304 wrote to memory of 4964	3304	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4964

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
b4d343a92110395f8280459348b204ad

SHA1
8fdaf824f3bd5e1acecc162cbaf0faf877c46b94

SHA256
dfc54c28a9f69122053281982b96429e92f61ecba116eda2caa66ad2dd4ce0e0

SHA512
5b798b557e9eaff8ed6c890159f85caf8a1e06c7eee67825d30b0c72bbd1ec8c64cf3d53f01aa4103665837a725ab4b6be8563c6676b6545af400673348951ca

Download Submit
memory/3304-4-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download
memory/3304-12-0x00000299E77A0000-0x00000299E77A1000-memory.dmp

Filesize
4KB

Download
memory/3304-17-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download
memory/3304-27-0x00000299E77A0000-0x00000299E77A1000-memory.dmp

Filesize
4KB

Download
memory/3304-28-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download
memory/3304-33-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download
memory/3304-38-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download
memory/3304-43-0x00000299E77A0000-0x00000299E77A1000-memory.dmp

Filesize
4KB

Download
memory/3304-44-0x00000299E8F90000-0x00000299E9F90000-memory.dmp

Filesize
16.0MB

Download