bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

POs, 17398902, PSB-18384789_M.V GRACE EPDAs _Updated List.jar
Size

177KB
MD5

94cac721e10982e4135f6a65e7121577
SHA1

df3caf4e1cc06d555f3e7fb251d405672ab8f961
SHA256

bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a
SHA512

1c98bd130524487732bc1a3b6174bd019ee76c011fcdcf8243197ac79936323b660ee042e35d63f7decfdc36a0db3604c283ce41083c7f448135fdb5b247d9eb
SSDEEP

3072:TvKFkSjnWvcSWO2V166DCKHHYY1Yj8QBznk7VPyXVd7CV925/KJh/:jHSj5/+6DCWHhkzk7Vqldt0Jt

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3560 icacls.exe

pid	process
3560	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2884 wrote to memory of 3560 2884 java.exe icacls.exe
PID 2884 wrote to memory of 3560 2884 java.exe icacls.exe

description	pid	process	target process
PID 2884 wrote to memory of 3560	2884	java.exe	icacls.exe
PID 2884 wrote to memory of 3560	2884	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\POs, 17398902, PSB-18384789_M.V GRACE EPDAs _Updated List.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
ac515809c2a373d23f48f06bfc1bb72a

SHA1
bda7083519fb3d562f5548fc95b7137842964685

SHA256
73b99bb6b83018e7781a972ea8e09585418b128078efa3329a360d59a075c317

SHA512
e405892a77cc2adfce5b5baf24890479bd571833ee816ae1cdd6901d0de853422115e89d0929f4cd032ba6da10bde297cfa0253ef3367f12cc1650a6121473df

Download Submit
memory/2884-34-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-12-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download
memory/2884-18-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-24-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-31-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download
memory/2884-4-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-37-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download
memory/2884-38-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-42-0x0000028738FA0000-0x0000028739FA0000-memory.dmp

Filesize
16.0MB

Download
memory/2884-50-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download
memory/2884-55-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download
memory/2884-81-0x0000028737760000-0x0000028737761000-memory.dmp

Filesize
4KB

Download