68e1bee1b1572e9610638b2f3493b49910857b28bb7e8d56e4246d9e906ec499

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Sorillus-Launcher v6.1.jar
Size 639KB
Sample240329-2ncq4sbe61
SHA256 1917afa516fb79da36ded6047e9cd7cc7413211acc55cf8fcef3c33f30e8f466
MD5 1372568356c7e3bda26552a536a320a0
SHA1 b6961dcfc1ba550274a3a51093eed8f2f99b8d3c
SHA512 0f15424913e30d36914b5855c7556502abb49168b6c72df760fdee83e16f1a7615a0739cdcc1a16715644bacbd238d08dc3e925ab852e03de4638d1398af297e
SSDEEP 12288:7nV4Qa/qICp8D4bY4wH/gI/dRP+9amNWJPgIhKRMt3quE2dkSdTD4q:7nGQO6p04Mn/gIn2vWJICfquZd3dTD4q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1832	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
408	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 1832	408	java.exe	86
PID 408 wrote to memory of 1832	408	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\Sorillus-Launcher v6.1.jar"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 145c938948e9711a84deda01b015291457b9d5171880f792d6133f5653d42c91
MD5 f08d1242f0bf2aa7b7343ca023c69018
SHA1 5bb784afb858da21ac69c39dfe67da122a13a2f7
SHA512 36427cd1253c99566015a6a64c41ad538aed147fb39bab40f5a17b48f9c313eef57e38748ccb9c540f664f2f9ffa5ed92ad1647093aea20d3c2033569e3833ad
MD5 SHA1 SHA512

Submit Download

memory/408-4-0x0000024EB8860000-0x0000024EB9860000-memory.dmp

Download

memory/408-15-0x0000024EB6FC0000-0x0000024EB6FC1000-memory.dmp

Download

memory/408-16-0x0000024EB6FC0000-0x0000024EB6FC1000-memory.dmp

Download

memory/408-21-0x0000024EB8860000-0x0000024EB9860000-memory.dmp

Download

memory/408-24-0x0000024EB8AE0000-0x0000024EB8AF0000-memory.dmp

Download

memory/408-25-0x0000024EB8AF0000-0x0000024EB8B00000-memory.dmp

Download

memory/408-26-0x0000024EB8B00000-0x0000024EB8B10000-memory.dmp

Download

memory/408-27-0x0000024EB8860000-0x0000024EB9860000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads