52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 02:36

Target

52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111.jar
Size

64KB
MD5

42e3509850681ccff160078d391581b9
SHA1

be3a6011ad989c9328c72cf318f06cbfa499cd82
SHA256

52b7bf1e5830bfba28165d96c48dcdc21eb28e313e1f0f1bcc10378e38e06111
SHA512

0628f0a7c9b2b2a73103ef2c6be0d1a40f6c658a6418d324ca0e7fad24a3367de6df01a237516865e03b36bb47bbb0eb2a9cb71a509e6c3dc48ab70d96d9671d
SSDEEP

1536:s/LvDzcVMHH4xoLPM4qxtOPLfqA09xtRd3W4Ur:sLD1HYxGWtOPLfos4Ur

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3076 icacls.exe

pid	process
3076	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1648 wrote to memory of 3076 1648 java.exe icacls.exe
PID 1648 wrote to memory of 3076 1648 java.exe icacls.exe

description	pid	process	target process
PID 1648 wrote to memory of 3076	1648	java.exe	icacls.exe
PID 1648 wrote to memory of 3076	1648	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
ff3c31f1ea08b44818c688d4ad2ebdfb

SHA1
da8d029c941467630e6f0d02e71204841cccfb58

SHA256
dc15254b4a1904a68bcc0526cf26a6ea29b769c439b03d9fb530f1c39744c8a8

SHA512
61cfbe6996ef58eb0261202aa1484f8c320f581474730816c83400397d606bce19ae397120c58025aaa1d20c3d5c2ed18f105cf5b170a83b1cb6719f36ca007a

Download Submit
memory/1648-4-0x0000015E351D0000-0x0000015E361D0000-memory.dmp

Filesize
16.0MB

Download