bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 02:29

Target

bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a.jar
Size

177KB
MD5

94cac721e10982e4135f6a65e7121577
SHA1

df3caf4e1cc06d555f3e7fb251d405672ab8f961
SHA256

bd22c177557b6308f9322e59ba69398705e1ab0c4f0b905ed8c3a42ba8e87c9a
SHA512

1c98bd130524487732bc1a3b6174bd019ee76c011fcdcf8243197ac79936323b660ee042e35d63f7decfdc36a0db3604c283ce41083c7f448135fdb5b247d9eb
SSDEEP

3072:TvKFkSjnWvcSWO2V166DCKHHYY1Yj8QBznk7VPyXVd7CV925/KJh/:jHSj5/+6DCWHhkzk7Vqldt0Jt

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4640 icacls.exe

pid	process
4640	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 116 wrote to memory of 4640 116 java.exe icacls.exe
PID 116 wrote to memory of 4640 116 java.exe icacls.exe

description	pid	process	target process
PID 116 wrote to memory of 4640	116	java.exe	icacls.exe
PID 116 wrote to memory of 4640	116	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4640

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
3d72de8654ad14c71de0ba921707b4de

SHA1
fbd8404311dbffc11718cc254ddd90220d73bf2a

SHA256
d1ad091344bca3ceb8c603c248d8cd550d795fb6a89594170aa5bfe2dae6c459

SHA512
e1dc9b49c4f2901026b430c67bab6cf8c61e4aa1d11468d65f78246758f2560c436e9d765fa69c17ac6ade07c593ea564559569c018ec4e8874d795faa198f6e

Download Submit
memory/116-4-0x000001F3A1780000-0x000001F3A2780000-memory.dmp

Filesize
16.0MB

Download
memory/116-12-0x000001F39FED0000-0x000001F39FED1000-memory.dmp

Filesize
4KB

Download
memory/116-16-0x000001F3A1780000-0x000001F3A2780000-memory.dmp

Filesize
16.0MB

Download
memory/116-21-0x000001F3A1A00000-0x000001F3A1A10000-memory.dmp

Filesize
64KB

Download
memory/116-22-0x000001F3A1780000-0x000001F3A2780000-memory.dmp

Filesize
16.0MB

Download
memory/116-23-0x000001F3A1780000-0x000001F3A2780000-memory.dmp

Filesize
16.0MB

Download