bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-03-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Attachment.jar
Size

177KB
MD5

94cac721e10982e4135f6a65e7121577
SHA1

df3caf4e1cc06d555f3e7fb251d405672ab8f961
SHA256

bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a
SHA512

1c98bd130524487732bc1a3b6174bd019ee76c011fcdcf8243197ac79936323b660ee042e35d63f7decfdc36a0db3604c283ce41083c7f448135fdb5b247d9eb
SSDEEP

3072:TvKFkSjnWvcSWO2V166DCKHHYY1Yj8QBznk7VPyXVd7CV925/KJh/:jHSj5/+6DCWHhkzk7Vqldt0Jt

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4736 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2788 wrote to memory of 4736 2788 java.exe icacls.exe
PID 2788 wrote to memory of 4736 2788 java.exe icacls.exe

pid	process
4736	icacls.exe

description	pid	process	target process
PID 2788 wrote to memory of 4736	2788	java.exe	icacls.exe
PID 2788 wrote to memory of 4736	2788	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Attachment.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
e5f879637e6fe06e3adf6795c74eed7a

SHA1
952b8e7d040d25c1d5a02681948181a94bda2f4a

SHA256
e46946d72797e808bc2bd60ef63057cfd0775bb7ff741cb394544be9392d07d6

SHA512
3b375286e7b36ea0462d5fdb6d90aef5a1ba4c8e173166616da86c36d4d4f913d1813736aab73b1a5edeed8ad9d1ad61a6337562d7aeec25a0b13b0eb173b4a2

Download Submit
memory/2788-46-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-20-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-52-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-63-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-28-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-34-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-37-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-4-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-105-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-16-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-27-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-70-0x0000023A86CA0000-0x0000023A86CA1000-memory.dmp

Filesize
4KB

Download
memory/2788-77-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-88-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-92-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-97-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-101-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download
memory/2788-50-0x0000023A884E0000-0x0000023A894E0000-memory.dmp

Filesize
16.0MB

Download