506208ef17c137ddc100e316b394479251184e622bc81a54250340d525e20a53

Analysis

max time kernel
115s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Talep-Formu.jar
Size

66KB
MD5

d3750bcff315622063c92704a3247186
SHA1

9f3807e776dee2c7fe0afa370c8ac8c6971dfab8
SHA256

506208ef17c137ddc100e316b394479251184e622bc81a54250340d525e20a53
SHA512

807e15c8ed8e988a01ca8af6f63b06ed897d2a77ac070c0a02370a789421fb741c785b846a24a0084a21c35dd1462dcdd08ddaef6c665112dd40a9b7e2bb1c1e
SSDEEP

1536:txuvjSsHfnuZ77A31Za/dDcvNrx7H2ldh:yvjSmnaU31ZOKNN2Lh

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3876	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 3876	1568	java.exe	94
PID 1568 wrote to memory of 3876	1568	java.exe	94

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Talep-Formu.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=780 --field-trial-handle=2272,i,11831746627654527593,10138103687018060346,262144 --variations-seed-version /prefetch:8
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d0dbedb8ec031cd43363116d0909fc7e

SHA1
34cb18c1df7eaccf20bb9539587166a652ca6390

SHA256
85bd37e11284d9fff68f207ff14656c5519064ecfe4109ae0eee9712238355a5

SHA512
b747787278c127669af78be9829c8d528b126139b077ca3ef75a780d3bd00a09abad684b871259e25c68bd9de462ca433cffef72ebbe4848accd4faa808a2e19

Download Submit
memory/1568-4-0x0000022E00000000-0x0000022E01000000-memory.dmp

Filesize
16.0MB

Download
memory/1568-12-0x0000022E76EB0000-0x0000022E76EB1000-memory.dmp

Filesize
4KB

Download