06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payment copy.jar
Size

175KB
MD5

26d3379ac09e8ceb0d88c1143dcf2446
SHA1

f4becfe1c6d0622a67071b513a163babbae16bfd
SHA256

06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116
SHA512

48c67ee68cf34de03484726e0beab9a97b61c2b98cc21049f852dd790449f580721d8d3d6326412c974769bb4ed144ac0bfb73eb0d9a20caba0d5afaf09bdc99
SSDEEP

3072:AI4ZqwQ46LT9iV0R9STkczeU6HaZIhUSnFj5dKEem6noMzBVp:FjwUP0V0R9rRLF9+7oMlL

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4560 icacls.exe

pid	process
4560	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3256 wrote to memory of 4560 3256 java.exe icacls.exe
PID 3256 wrote to memory of 4560 3256 java.exe icacls.exe

description	pid	process	target process
PID 3256 wrote to memory of 4560	3256	java.exe	icacls.exe
PID 3256 wrote to memory of 4560	3256	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Payment copy.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
7e922c3f327bbf2578f9d7a6d02df1fe

SHA1
254542e43c5d94d54ba39e7579bf3f09337d37c2

SHA256
a963e8e0e1ad3d99e4aa273ca8383e8642b0b1e11663022c80928f56f98c09cc

SHA512
e85851216059549e4c5981e0b68541daa67865b0e06a73265a1d471ed3005f4747efae4d42323272eea30edae9671163cb891e1bc70adf74b6d0a8e0af191f8a

Download Submit
memory/3256-41-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-36-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-16-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-24-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-44-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-32-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-14-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-4-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-30-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-57-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-62-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-79-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-80-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-86-0x0000027619250000-0x0000027619251000-memory.dmp

Filesize
4KB

Download
memory/3256-104-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download
memory/3256-107-0x000002761AA40000-0x000002761BA40000-memory.dmp

Filesize
16.0MB

Download