7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7.jar
Size

182KB
MD5

4bb9375408befc34f88aa2ed81bd7d6a
SHA1

211ccad4ebf6678fd31145515d071abea0bf54d0
SHA256

7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7
SHA512

0ef4022e12a7a96b48d224b3ee740e97c1bb6e8033c632d025eaa246dcbb545be67aa1b36219d24dc1459a80f41802a4344ead55c994a424d1c4e777cebb2be3
SSDEEP

3072:IWwzAwQy6xRrY/Cr9SzamFe86HaZahwS1Xj57YOemqVcSxsZzVBr:fzwCTE/Cr9xnNX9cLaSx659

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4728 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1164 wrote to memory of 4728 1164 java.exe icacls.exe
PID 1164 wrote to memory of 4728 1164 java.exe icacls.exe

pid	process
4728	icacls.exe

description	pid	process	target process
PID 1164 wrote to memory of 4728	1164	java.exe	icacls.exe
PID 1164 wrote to memory of 4728	1164	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\7a540128e18a205052c12e1ef416df4f7aa0d18a130fd4580aac2fe6991c83c7.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
bbff279fb96a1c9aba07ab3c9fa15c67

SHA1
f3612f2f9f2efeb88f4af95411bf918c54e667e0

SHA256
4d8cd3018a787f132d4ee4ec2ca85c207c50cde33e393dfa4705aefe92096749

SHA512
68df8adc9e907b85fd0797e72c786d122e4b35ca77a3334808b4be45ee0201b3068602ab52aca8323d6b45300d38cf016ff4cefeeb0c74428b3a910b2dc5f9e9

Download Submit
memory/1164-50-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-45-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-17-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-18-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-55-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-30-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-15-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-4-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-27-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-63-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-64-0x000001376E420000-0x000001376F420000-memory.dmp

Filesize
16.0MB

Download
memory/1164-65-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-67-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-81-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-84-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download
memory/1164-103-0x000001376E400000-0x000001376E401000-memory.dmp

Filesize
4KB

Download