3be0cdc4b221e128b5176c276018c0bfb942872bb8b5cc46b1e8c87c4b1e0f37

Analysis

max time kernel
14s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a704635a31b878b7ccb0c3748be4c0a78050facb.jar
Size

209KB
MD5

2631f382e1331a43ac6e6ad95e5388ca
SHA1

a704635a31b878b7ccb0c3748be4c0a78050facb
SHA256

a8feb910ca86e5082fbabffab4e148795772c8a334d25714a8d8b03cf84db50f
SHA512

c4ea3ce981c10ac065e714c27299ad60dc9abc12964f206bb7279db4388a1d08ee415407cc13074e54ab177f369c492ef9d17f93df598f32d25b6b0452c80c99
SSDEEP

6144:zKR81J1HN/AoduekzyURzqV8sQSeuKPLVmyKs:zK+1jdTBk/28sQSSRKs

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1128 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 628 wrote to memory of 1128 628 java.exe icacls.exe
PID 628 wrote to memory of 1128 628 java.exe icacls.exe

pid	process
1128	icacls.exe

description	pid	process	target process
PID 628 wrote to memory of 1128	628	java.exe	icacls.exe
PID 628 wrote to memory of 1128	628	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a704635a31b878b7ccb0c3748be4c0a78050facb.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1128

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
b8e14d7578eb1d020fef73de966cb86c

SHA1
142269289e61dc81957aad54068df4b0db035b75

SHA256
daeaf532db8284240f06d263dd97f620f1d2d222615d9a93a641aded98100852

SHA512
88a068d702778ee9e4ed52968d97be131a80d3b5d7f3de54f7a59bb9fd1f61dc8e07c48542cd643b84ee1fc87cf7c7548a587842efbc27ae3c8591b198605a79

Download Submit
memory/628-4-0x000001E0D9650000-0x000001E0DA650000-memory.dmp

Filesize
16.0MB

Download
memory/628-17-0x000001E0D9650000-0x000001E0DA650000-memory.dmp

Filesize
16.0MB

Download
memory/628-18-0x000001E0D7DB0000-0x000001E0D7DB1000-memory.dmp

Filesize
4KB

Download