ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 07:35

Target

Telexcopy.pdf.jar
Size

395KB
MD5

81e621517a407ae36da0a767b960c88c
SHA1

421f3489d10b803e2dd64d0b47ce619da2da448a
SHA256

ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1
SHA512

cd0510723447c5ace63f4ec9eb1aa0aa7d9d56b70f08b16c92c71b9825351122e59c1b5173e1e7288f59a8d732be122e90be397521f80e71328d743ad172788c
SSDEEP

192:WtZ3hAJtjmbwOqaI55LEOkOYiDiMkCjvDhvLlSIz3v4M3LwsUE+1MB7hikCOrPiH:cZ3hOOJvsEOWGWCjvSmwM7wsTvQMC

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5116 icacls.exe

pid	process
5116	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4116 wrote to memory of 5116 4116 java.exe icacls.exe
PID 4116 wrote to memory of 5116 4116 java.exe icacls.exe

description	pid	process	target process
PID 4116 wrote to memory of 5116	4116	java.exe	icacls.exe
PID 4116 wrote to memory of 5116	4116	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:5116

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
30f567c711f465b48201082b92251936

SHA1
e7cd44fa486eb525f2185f29634ad8ee0ea8d373

SHA256
03915fb78039e8bebf124e06316bca402ca83944227d0ccc822503d73f817561

SHA512
3a032d345949467d44c0dc4e1b6b036fa0beabc81c957aa67c840747b8e4d7dfc3c0047d01db7653cbf26061951306ddc39d4cfc3e029f45996a4616441c64e7

Download Submit
memory/4116-4-0x0000022B80000000-0x0000022B81000000-memory.dmp

Filesize
16.0MB

Download
memory/4116-12-0x0000022BF7AF0000-0x0000022BF7AF1000-memory.dmp

Filesize
4KB

Download
memory/4116-18-0x0000022B80000000-0x0000022B81000000-memory.dmp

Filesize
16.0MB

Download
memory/4116-20-0x0000022B80280000-0x0000022B80290000-memory.dmp

Filesize
64KB

Download
memory/4116-21-0x0000022B80290000-0x0000022B802A0000-memory.dmp

Filesize
64KB

Download
memory/4116-22-0x0000022B802A0000-0x0000022B802B0000-memory.dmp

Filesize
64KB

Download
memory/4116-23-0x0000022B80000000-0x0000022B81000000-memory.dmp

Filesize
16.0MB

Download