Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 16:24
Behavioral task
behavioral1
Sample
PO#0015871.jar
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PO#0015871.jar
Resource
win10v2004-20231215-en
General
-
Target
PO#0015871.jar
-
Size
167KB
-
MD5
df7be0365b1ed92efa70ea5bc070f19c
-
SHA1
5c6d506244d85222a25f25a93d7400d71a7b527a
-
SHA256
56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e
-
SHA512
19f6e1ea3a63f422eb5c6dc5622722caea5debbec6042a770f364c050d11ec6b09adba765dfa3a74a47f457287cf7f5cffd8e08909b96dc25df5cbfbf6a235dd
-
SSDEEP
3072:T3FFxl3/W/7n3ZaVfK+7dkKwvBMxMI61Bd4+tEveaYARpzUPxOeQfebl2fXqAwWy:T3FFbUVao+S91BdfK2adzAx8eR2fqVX
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
Processes:
java.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\bin\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb java.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 4784 wrote to memory of 3292 4784 java.exe icacls.exe PID 4784 wrote to memory of 3292 4784 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\PO#0015871.jar1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD52fa3e744b6f168699f6f4a7f9d887dfc
SHA15eb53f67ceca89600d4855cdf962120ed8811411
SHA256c669132d975fb5bd9baa8f12153fde1cb94d57fa36730721e26d2d4267fcf34c
SHA512908a0b8113db581eb671407fe91c4f6f874ce2c57e7aa9b81c8da6b0c1e38b1965ee7494b9c2e22341a8d61d820ed844856ef299a3c4d8244ebad9a9eb2524b6
-
memory/4784-37-0x000001EDC9300000-0x000001EDC9310000-memory.dmpFilesize
64KB
-
memory/4784-35-0x000001EDC92D0000-0x000001EDC92E0000-memory.dmpFilesize
64KB
-
memory/4784-17-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB
-
memory/4784-26-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB
-
memory/4784-38-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB
-
memory/4784-36-0x000001EDC9330000-0x000001EDC9340000-memory.dmpFilesize
64KB
-
memory/4784-12-0x000001EDC7810000-0x000001EDC7811000-memory.dmpFilesize
4KB
-
memory/4784-4-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB
-
memory/4784-29-0x000001EDC7810000-0x000001EDC7811000-memory.dmpFilesize
4KB
-
memory/4784-39-0x000001EDC9310000-0x000001EDC9320000-memory.dmpFilesize
64KB
-
memory/4784-40-0x000001EDC9320000-0x000001EDC9330000-memory.dmpFilesize
64KB
-
memory/4784-41-0x000001EDC9340000-0x000001EDC9350000-memory.dmpFilesize
64KB
-
memory/4784-42-0x000001EDC9360000-0x000001EDC9370000-memory.dmpFilesize
64KB
-
memory/4784-43-0x000001EDC9370000-0x000001EDC9380000-memory.dmpFilesize
64KB
-
memory/4784-44-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB
-
memory/4784-45-0x000001EDC9050000-0x000001EDCA050000-memory.dmpFilesize
16.0MB