ae0731b6dbed0f25ed10fea73c536be4a73a5d2a82a0026e0ecb99edc9160c28

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunchLegacy.jar
Size

23KB
MD5

b8e412180e698ecb3757a09c134191cc
SHA1

cb74a42d73f11c05a58d4bbe99666195741a6075
SHA256

149f50cc64844459322a8da8c62b3b97597d2302deb46a97be0279a8327382b8
SHA512

727d8b48a34ce083c26ec3b0622a23f0d15f44deea2e19af7d643a390dcd6d6b1ff2e08134d2a87175ca86fdb6436c1eb8ba5072cf52d1f674c779bf53a48cde
SSDEEP

384:MVVL1jDPUfYnONklSEaxh1jp8Buc6gd9rFXTbHD/8SkWlwP5:MVVP1lGh1j+Gy9RXTjD/8Sk2wP5

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2468 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4624 wrote to memory of 2468 4624 java.exe icacls.exe
PID 4624 wrote to memory of 2468 4624 java.exe icacls.exe

pid	process
2468	icacls.exe

description	pid	process	target process
PID 4624 wrote to memory of 2468	4624	java.exe	icacls.exe
PID 4624 wrote to memory of 2468	4624	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunchLegacy.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
5cdd31fecfd67e13587051f8862b7771

SHA1
fc001b4eb9ce3f02e036fe07d1013067b3f02311

SHA256
f61e437e7e374109072dad01def5a7e70234c3e300fe8c642719e05e8783f5cd

SHA512
d2933a35ff18b888210f07b1e47e0f8a532dce1b4e2556fc3964eebbb6b41760c3b41a776f67fb3d8aedb9ce9842094dfb1b037be28a41b87c0a3ce50f3d007b

Download Submit
memory/4624-4-0x000001BB0BC50000-0x000001BB0CC50000-memory.dmp

Filesize
16.0MB

Download
memory/4624-12-0x000001BB0A380000-0x000001BB0A381000-memory.dmp

Filesize
4KB

Download