f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7

Analysis

max time kernel
139s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 07:24

Target

CTIKUL SOA.jar
Size

182KB
MD5

e811acc241956da28397cfc904a208f8
SHA1

53ae77b97e46e1c0ead31f9441bb93ff0b365750
SHA256

f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7
SHA512

f0234c99c07523f9cc85574e387523696dd3d299dbdb83c4e975ead7af2b36452283392945168cb12da763e8ec2c95e9c2e205a9bfd4b74b8de52d1f97e1e4e3
SSDEEP

3072:AI4ZqwQ46LT9iV0R9STkczeU6HaZIhUSnFj5dKEem6noUxspzBVp:FjwUP0V0R9rRLF9+7oUxSl7

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2584 icacls.exe

pid	process
2584	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3216 wrote to memory of 2584 3216 java.exe icacls.exe
PID 3216 wrote to memory of 2584 3216 java.exe icacls.exe

description	pid	process	target process
PID 3216 wrote to memory of 2584	3216	java.exe	icacls.exe
PID 3216 wrote to memory of 2584	3216	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
5d3ffca2a5c2bdf5a7a329498c97c4c4

SHA1
b18285dfed81cb64ee9c3272a68e464b4a116276

SHA256
6737912c23b73ebced9282d88e732d7612dd566ec5ad81eb0454660d35c43d8c

SHA512
01ea2fa6a62a00860fd8d05a9cbaf8657eaa5371f0b6f64a6c8dd1e325becee520bef1f06106fc434c5ce88d3e66f24132a842901c8d5aa745e05dd3bb33ac67

Download Submit
memory/3216-4-0x000002C900000000-0x000002C901000000-memory.dmp

Filesize
16.0MB

Download
memory/3216-14-0x000002C900000000-0x000002C901000000-memory.dmp

Filesize
16.0MB

Download
memory/3216-16-0x000002C900000000-0x000002C901000000-memory.dmp

Filesize
16.0MB

Download