6c0658315b96ee5b7c95c60279714f9c95017fb22f451c5a73af91583889f1c1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6f8a0a71fa4e9b4f871bd262dda7c0c1_JaffaCakes118.jar
Size 184KB
Sample240401-mhtp4sce64
SHA256 6c0658315b96ee5b7c95c60279714f9c95017fb22f451c5a73af91583889f1c1
MD5 6f8a0a71fa4e9b4f871bd262dda7c0c1
SHA1 8ae0166ac5d5a98cd379fd124829a5877d16e770
SHA512 1b5e806fcdbc5abca5f16fc1974125b38bb41b2800a4bd981ea4c08dab6f9b3e391b04f2e581672de3e756a1fa8f08fe297376bf687fc8ebd11693f75bd4fbdc
SSDEEP 3072:UvUXwAKU6YzXgPkGh7Hs6E63edIo6ieoZlQhgl1OJiotZR5N1PJQtIcY7GG/q+7g:pXiazwPkGhPE63A6ab1mYWflT7GGyqs5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4812	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 4812	4228	java.exe	86
PID 4228 wrote to memory of 4812	4228	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\6f8a0a71fa4e9b4f871bd262dda7c0c1_JaffaCakes118.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 f0b48e45f924c85c6cb8c1dbe5043594d1d7fa12af376e9f10f56a7daec9ba75
MD5 491be6829f7e6c1745059344ab0506cb
SHA1 dbfb5048f14908a03564748df5d03da79807ff34
SHA512 b5afc5706d92b2aad10bc529325700928afb842960c2600ce7abfbfa47e5ccdef199ddfffedaee8262d97991bfceb6b9a3264a7db8cbff783fad98e8017d23a6
MD5 SHA1 SHA512

Submit Download

memory/4228-39-0x000002A032850000-0x000002A032860000-memory.dmp

Download

memory/4228-40-0x000002A032870000-0x000002A032880000-memory.dmp

Download

memory/4228-18-0x000002A0325A0000-0x000002A0335A0000-memory.dmp

Download

memory/4228-27-0x000002A032580000-0x000002A032581000-memory.dmp

Download

memory/4228-28-0x000002A0325A0000-0x000002A0335A0000-memory.dmp

Download

memory/4228-36-0x000002A032820000-0x000002A032830000-memory.dmp

Download

memory/4228-38-0x000002A032840000-0x000002A032850000-memory.dmp

Download

memory/4228-4-0x000002A0325A0000-0x000002A0335A0000-memory.dmp

Download

memory/4228-12-0x000002A032580000-0x000002A032581000-memory.dmp

Download

memory/4228-41-0x000002A032880000-0x000002A032890000-memory.dmp

Download

memory/4228-37-0x000002A0328A0000-0x000002A0328B0000-memory.dmp

Download

memory/4228-42-0x000002A032890000-0x000002A0328A0000-memory.dmp

Download

memory/4228-45-0x000002A0328C0000-0x000002A0328D0000-memory.dmp

Download

memory/4228-44-0x000002A0328B0000-0x000002A0328C0000-memory.dmp

Download

memory/4228-43-0x000002A0325A0000-0x000002A0335A0000-memory.dmp

Download

memory/4228-46-0x000002A0328D0000-0x000002A0328E0000-memory.dmp

Download

memory/4228-47-0x000002A0328E0000-0x000002A0328F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads