f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20.jar
Size

163KB
MD5

a22184b2e7c7673c4c37bc5c08c6f011
SHA1

1af5a401e967998de2733bee4da5878bb0caf30d
SHA256

f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20
SHA512

4d28fdc16b86283a4d7ffb1b2dc943b632f12163aabbd69aa2af9d2bb14c914eaf50f08233a3f4d499e3cc3076a3679018e085b8201eb9ecc8c0742552a4a334
SSDEEP

3072:5KqqJ8EPFDwH4E2A52puSdBGb//BtrbMg+Og5yG8C65F9y/9E2MGDBv:54nJww0QuSzuXBtrgieeDElVND5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1804 icacls.exe

pid	process
1804	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3676 wrote to memory of 1804 3676 java.exe icacls.exe
PID 3676 wrote to memory of 1804 3676 java.exe icacls.exe

description	pid	process	target process
PID 3676 wrote to memory of 1804	3676	java.exe	icacls.exe
PID 3676 wrote to memory of 1804	3676	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\f888b04e753216a6924c56efa705c71fd9682cb9b8f241d6cfc79fe3cdf62b20.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3676

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3992 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
1⤵
PID:3356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
eba4abb61c04f4de6fcfd49a386cb47c

SHA1
cc0cf3eadbea7a42a63faa3fd82ff67820ed0de4

SHA256
cf367832e96d24c5b470593509ec93c608190eb4b91212b71599027c2fb7ed5d

SHA512
4634482e63a11e09759851b88b72bc1f24ecb29179be8839a262d1303da2c58ef50bbabca4227529238e35a397372878ef1ab27c76aff274a305eec705b649b7

Download Submit
memory/3676-36-0x0000029DA9210000-0x0000029DA9220000-memory.dmp

Filesize
64KB

Download
memory/3676-12-0x0000029DA7660000-0x0000029DA7661000-memory.dmp

Filesize
4KB

Download
memory/3676-18-0x0000029DA8F10000-0x0000029DA9F10000-memory.dmp

Filesize
16.0MB

Download
memory/3676-31-0x0000029DA8F10000-0x0000029DA9F10000-memory.dmp

Filesize
16.0MB

Download
memory/3676-37-0x0000029DA91B0000-0x0000029DA91C0000-memory.dmp

Filesize
64KB

Download
memory/3676-2-0x0000029DA8F10000-0x0000029DA9F10000-memory.dmp

Filesize
16.0MB

Download
memory/3676-35-0x0000029DA9190000-0x0000029DA91A0000-memory.dmp

Filesize
64KB

Download
memory/3676-38-0x0000029DA91C0000-0x0000029DA91D0000-memory.dmp

Filesize
64KB

Download
memory/3676-40-0x0000029DA91F0000-0x0000029DA9200000-memory.dmp

Filesize
64KB

Download
memory/3676-39-0x0000029DA91D0000-0x0000029DA91E0000-memory.dmp

Filesize
64KB

Download
memory/3676-41-0x0000029DA91E0000-0x0000029DA91F0000-memory.dmp

Filesize
64KB

Download
memory/3676-42-0x0000029DA9220000-0x0000029DA9230000-memory.dmp

Filesize
64KB

Download
memory/3676-43-0x0000029DA8F10000-0x0000029DA9F10000-memory.dmp

Filesize
16.0MB

Download
memory/3676-44-0x0000029DA8F10000-0x0000029DA9F10000-memory.dmp

Filesize
16.0MB

Download