56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e

General

Target

56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e.jar
Size

167KB
MD5

df7be0365b1ed92efa70ea5bc070f19c
SHA1

5c6d506244d85222a25f25a93d7400d71a7b527a
SHA256

56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e
SHA512

19f6e1ea3a63f422eb5c6dc5622722caea5debbec6042a770f364c050d11ec6b09adba765dfa3a74a47f457287cf7f5cffd8e08909b96dc25df5cbfbf6a235dd
SSDEEP

3072:T3FFxl3/W/7n3ZaVfK+7dkKwvBMxMI61Bd4+tEveaYARpzUPxOeQfebl2fXqAwWy:T3FFbUVao+S91BdfK2adzAx8eR2fqVX

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2568	icacls.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\DLL\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\DLL\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ucrtbase.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\DLL\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\DLL\kernel32.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2568	4640	java.exe	97
PID 4640 wrote to memory of 2568	4640	java.exe	97

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\56adddced8be369b725c6c4db11ab5579dc88c40cbca16715db7a1e60da2fc3e.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4180 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c90df59156352d391e8a2c0dac5a5b85

SHA1
cf520da956d239daadd40d0902e4a3f101913d7f

SHA256
aa0eb4246528bfa374fdb91edf9f66abbf1c4227f6bf4eb51cde66a991c71488

SHA512
646a8522d2605008bffa91d4499a91190e74a3e339c68a0e853ad450866b5fa472a2e6342f35a36bc2c4f449a65e48db3dd1381de627471853c8c3d0d753e66d

Download Submit
memory/4640-33-0x000001385F0B0000-0x000001385F0B1000-memory.dmp

Filesize
4KB

Download
memory/4640-12-0x000001385F0B0000-0x000001385F0B1000-memory.dmp

Filesize
4KB

Download
memory/4640-19-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download
memory/4640-25-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download
memory/4640-27-0x000001385F0B0000-0x000001385F0B1000-memory.dmp

Filesize
4KB

Download
memory/4640-2-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download
memory/4640-35-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download
memory/4640-48-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download
memory/4640-65-0x000001385F0B0000-0x000001385F0B1000-memory.dmp

Filesize
4KB

Download
memory/4640-82-0x000001385F0B0000-0x000001385F0B1000-memory.dmp

Filesize
4KB

Download
memory/4640-93-0x0000013860C50000-0x0000013860C60000-memory.dmp

Filesize
64KB

Download
memory/4640-94-0x0000013860C30000-0x0000013860C40000-memory.dmp

Filesize
64KB

Download
memory/4640-95-0x0000013860C40000-0x0000013860C50000-memory.dmp

Filesize
64KB

Download
memory/4640-96-0x00000138608C0000-0x00000138618C0000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing