Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2024 02:36
Behavioral task
behavioral1
Sample
f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7.jar
Resource
win10v2004-20240226-en
General
-
Target
f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7.jar
-
Size
182KB
-
MD5
e811acc241956da28397cfc904a208f8
-
SHA1
53ae77b97e46e1c0ead31f9441bb93ff0b365750
-
SHA256
f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7
-
SHA512
f0234c99c07523f9cc85574e387523696dd3d299dbdb83c4e975ead7af2b36452283392945168cb12da763e8ec2c95e9c2e205a9bfd4b74b8de52d1f97e1e4e3
-
SSDEEP
3072:AI4ZqwQ46LT9iV0R9STkczeU6HaZIhUSnFj5dKEem6noUxspzBVp:FjwUP0V0R9rRLF9+7oUxSl7
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1232 wrote to memory of 4952 1232 java.exe icacls.exe PID 1232 wrote to memory of 4952 1232 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\f153105a307e9bc3457b4203f1920a1cef9ac4e14bb1e460d24685b78781e1d7.jar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD50d65c4f2fd1291b508f4a3b7cfe65884
SHA1531b96f07b1368b9542b66ab034e278e14dee2a9
SHA25689d69f3db54465b84ef77da609d147e7523816e13db96be328829794dac3f1b8
SHA512c2cfee5b74dec45e3c0e59a15ecf13c5b771833ea4ebc44cd785e277f3f1a144aa8fac143ac49d5e3fd7ba438bd413df1705c3422cd79acdbc2aaa5a862d49eb
-
memory/1232-48-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-12-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-19-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-29-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-33-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-8-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-55-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-56-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-60-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-63-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-64-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB
-
memory/1232-102-0x0000027110BC0000-0x0000027110BC1000-memory.dmpFilesize
4KB
-
memory/1232-159-0x0000027112390000-0x0000027113390000-memory.dmpFilesize
16.0MB