06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116.jar
Size

175KB
MD5

26d3379ac09e8ceb0d88c1143dcf2446
SHA1

f4becfe1c6d0622a67071b513a163babbae16bfd
SHA256

06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116
SHA512

48c67ee68cf34de03484726e0beab9a97b61c2b98cc21049f852dd790449f580721d8d3d6326412c974769bb4ed144ac0bfb73eb0d9a20caba0d5afaf09bdc99
SSDEEP

3072:AI4ZqwQ46LT9iV0R9STkczeU6HaZIhUSnFj5dKEem6noMzBVp:FjwUP0V0R9rRLF9+7oMlL

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2676 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2124 wrote to memory of 2676 2124 java.exe icacls.exe
PID 2124 wrote to memory of 2676 2124 java.exe icacls.exe

pid	process
2676	icacls.exe

description	pid	process	target process
PID 2124 wrote to memory of 2676	2124	java.exe	icacls.exe
PID 2124 wrote to memory of 2676	2124	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\06cfaf2421b7e81f53767e73c3d8731a631ed54697a17c0190adac199449a116.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2124

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
5d2a31df17d7a697fd6938742cf59989

SHA1
5b19f655ec44c3445365748e7952daa981459ef4

SHA256
14c58d94bc94621d925a5e914fa0fd645a8e30a46a5879817991d957bc7f54e4

SHA512
bcadc8760e22afa4561c72d535b43d10543f38d8f463197cc13fa529746c83e25ed1eb95efcff14135acd4e826ff5b69b12a4478d830e972332cdaf380ac2f42

Download Submit
memory/2124-46-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-18-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-19-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-29-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-32-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-4-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-56-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-57-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-58-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-64-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download
memory/2124-73-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-78-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-99-0x00000239C7410000-0x00000239C7411000-memory.dmp

Filesize
4KB

Download
memory/2124-136-0x00000239C8CD0000-0x00000239C9CD0000-memory.dmp

Filesize
16.0MB

Download