Analysis

  • max time kernel
    139s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 14:42

General

  • Target

    ProjectGitHubMain/bin/UbuilderS.exe

  • Size

    3.6MB

  • MD5

    8627fd537e892afae534c5e07f50b2c3

  • SHA1

    8b90cc232744e7f0a1d27f5b4ec4f6d0d966ed9a

  • SHA256

    09f156b3d7d51dad5a9ddd04f9685882a2d479e56deda6eaa0e58ecb19c19228

  • SHA512

    1af58aeda603230a0091c5d871ac88773f2b57a835c42c36ebb79e2cc39c7c0edf795bf039bb0eface4303b2b9fb5c3878d8a5364e7d3b73daa26fc392c1da70

  • SSDEEP

    49152:LC/+vwyHnNfERTPokBMyHJWGs8FaRMqu3XCqRq8stcpVk4JobxJ17IxRYbwPmmkO:szyHnN+TBrHJWGs2NyqeoNE/7SRYYCO

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProjectGitHubMain\bin\UbuilderS.exe
    "C:\Users\Admin\AppData\Local\Temp\ProjectGitHubMain\bin\UbuilderS.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\ProjectGitHubMain\bin\UbuilderS.exe" org.develnext.jphp.ext.javafx.FXLauncher
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:60
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:3652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    a1079a6237062df888cabf07d7af7279

    SHA1

    3a1253c6b952169b9da76442599531b1f82a85a2

    SHA256

    694e9af625ef58d5b99f09038d72772c13bce78f1e25419a63f552922351b20a

    SHA512

    731c5d67017bd326949649814e91c8f7786cf9b4ed0b6304fb103e512fac5a496fcbe438a90a6a585c9c27fc082c80c01ee7853e45952c90254ed2467ba5cdbd

  • memory/60-46-0x000002166FA40000-0x000002166FA50000-memory.dmp

    Filesize

    64KB

  • memory/60-55-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-45-0x000002166FAC0000-0x000002166FAD0000-memory.dmp

    Filesize

    64KB

  • memory/60-18-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-28-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-39-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-43-0x000002166F9F0000-0x000002166FA00000-memory.dmp

    Filesize

    64KB

  • memory/60-44-0x000002166FA20000-0x000002166FA30000-memory.dmp

    Filesize

    64KB

  • memory/60-13-0x000002166DEB0000-0x000002166DEB1000-memory.dmp

    Filesize

    4KB

  • memory/60-5-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-50-0x000002166FA70000-0x000002166FA80000-memory.dmp

    Filesize

    64KB

  • memory/60-47-0x000002166FA50000-0x000002166FA60000-memory.dmp

    Filesize

    64KB

  • memory/60-48-0x000002166FA60000-0x000002166FA70000-memory.dmp

    Filesize

    64KB

  • memory/60-49-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/60-53-0x000002166FAA0000-0x000002166FAB0000-memory.dmp

    Filesize

    64KB

  • memory/60-51-0x000002166FA80000-0x000002166FA90000-memory.dmp

    Filesize

    64KB

  • memory/60-52-0x000002166FA90000-0x000002166FAA0000-memory.dmp

    Filesize

    64KB

  • memory/60-54-0x000002166F770000-0x0000021670770000-memory.dmp

    Filesize

    16.0MB

  • memory/4192-0-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB