ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 02:39

Target

ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1.jar
Size

395KB
MD5

81e621517a407ae36da0a767b960c88c
SHA1

421f3489d10b803e2dd64d0b47ce619da2da448a
SHA256

ca438598c383fab834c5e52369032e30c657f8f70cbb095f181ea7779d34bba1
SHA512

cd0510723447c5ace63f4ec9eb1aa0aa7d9d56b70f08b16c92c71b9825351122e59c1b5173e1e7288f59a8d732be122e90be397521f80e71328d743ad172788c
SSDEEP

192:WtZ3hAJtjmbwOqaI55LEOkOYiDiMkCjvDhvLlSIz3v4M3LwsUE+1MB7hikCOrPiH:cZ3hOOJvsEOWGWCjvSmwM7wsTvQMC

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4912 icacls.exe

pid	process
4912	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1704 wrote to memory of 4912 1704 java.exe icacls.exe
PID 1704 wrote to memory of 4912 1704 java.exe icacls.exe

description	pid	process	target process
PID 1704 wrote to memory of 4912	1704	java.exe	icacls.exe
PID 1704 wrote to memory of 4912	1704	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4912

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c075fc57076f657521baefee534fce69

SHA1
15e0a94bd7cde28489126eb5119aa4b4ad60ee0a

SHA256
677112ea08146a65128ebe5f5d2351563d660d19122ec46addd00792e335a35b

SHA512
5659d1daeab0cf166cbb9a9cb20ee7e5b1a8c5f34d40cf312789c88785f4cc331386b173f2108b178d94f80fb683d189b0fea2c5cc7c70e1b3c1825fb1cfe9d7

Download Submit
memory/1704-4-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download
memory/1704-12-0x00000295C72B0000-0x00000295C72B1000-memory.dmp

Filesize
4KB

Download
memory/1704-19-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download
memory/1704-27-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download
memory/1704-34-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download
memory/1704-39-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download
memory/1704-43-0x00000295C8A80000-0x00000295C9A80000-memory.dmp

Filesize
16.0MB

Download