00d5640fdd3c1dd3baca7b092ec5aba640394a254477f79a9a58e2c9732babeb

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58033c34f29d72ad5baebf2193d17d73_JaffaCakes118.jar
Size 184KB
Sample240331-tkqvkafb24
SHA256 00d5640fdd3c1dd3baca7b092ec5aba640394a254477f79a9a58e2c9732babeb
MD5 58033c34f29d72ad5baebf2193d17d73
SHA1 780ef4d0957c081f17928c16a21cda1240c0a2a0
SHA512 5e90aa6de3bfe2f2e7c60262504f3ae1f6b34d3fe6e2810230a764440ee0bac91409d4011ae0756582051766f9e4be88c26ba630374cd70093119ecb603c8808
SSDEEP 3072:xzoOjHvZrRuCuCg37SKJ3rCFF24ht9LLznwaJuSchmi+Kjyk9A6ppq/DdmHjN/j3:xzrbZrMWNv5TJK99jERcDhmpE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3996	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 3996	4072	java.exe	85
PID 4072 wrote to memory of 3996	4072	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\58033c34f29d72ad5baebf2193d17d73_JaffaCakes118.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 310cbb433fa01136e07f328b91e8dea30b83f188a280b86851cf186415feeaee
MD5 82a20b11b9eac67f862e5667e286151d
SHA1 eb9e68ba3cb0c4562ae46f5f2952585c91993eda
SHA512 1836a2df71a05d71d4a4d6983636593abeb955c8c2f04922dae745fad2c271c0936306ae33d6d07d7ca7ade562268667a505b8750c71ae1f95bd55cfe507b34d
MD5 SHA1 SHA512

Submit Download

memory/4072-34-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-12-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-14-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-20-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-30-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-4-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-36-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-50-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-61-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-68-0x0000022780000000-0x0000022781000000-memory.dmp

Download

memory/4072-72-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-81-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-85-0x00000227F8A80000-0x00000227F8A81000-memory.dmp

Download

memory/4072-124-0x0000022780000000-0x0000022781000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads