cd2b9d9baaab804facdaec1e54b2d1606c1fbfdd5372f1965631a26f957bcc6f

Analysis

max time kernel
137s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94c622790b53ebc89c7f0837d95e9d8e_JaffaCakes118.jar
Size

184KB
MD5

94c622790b53ebc89c7f0837d95e9d8e
SHA1

12eeb397fa6559dc25801c814a673db269777c4b
SHA256

cd2b9d9baaab804facdaec1e54b2d1606c1fbfdd5372f1965631a26f957bcc6f
SHA512

2bd8fb1e5e0cf277f95fac27e30e8c1c4682482cdfa38e529f48c650f1f9f9008af8dec2bf4da2d60cf38850dae95885a405da68e55a0912b61964385e515939
SSDEEP

3072:NJWzA/RLMAwi1TPuEN2RAilVsSrHjlfP8o4yH1e9A7mM0gHHWg6mFtGuWHKj9x:DViCT2o/iv3DlfkOmA7d0gHoEtVWU7

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2220	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2220	1448	java.exe	96
PID 1448 wrote to memory of 2220	1448	java.exe	96

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\94c622790b53ebc89c7f0837d95e9d8e_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5328 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:8
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
2a67ab291b18c4178aad1144d611a4d7

SHA1
d98f0e972195297a9298a79bb779be7837a2db60

SHA256
7301cfd6e20121b5d38368048d5556c5d2b97ab349ad82f32ae357e91208bfbe

SHA512
4e003693c8a90a814e018390a5f37c73de25d186977ac4d501c51eb59ffaa83879e3ce27d45b32b1add835d1b60930b1c66f388c3138a0f6c4910ae69d505c60

Download Submit
memory/1448-4-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download
memory/1448-12-0x00000251230C0000-0x00000251230C1000-memory.dmp

Filesize
4KB

Download
memory/1448-19-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download
memory/1448-29-0x00000251230C0000-0x00000251230C1000-memory.dmp

Filesize
4KB

Download
memory/1448-34-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download
memory/1448-47-0x00000251230C0000-0x00000251230C1000-memory.dmp

Filesize
4KB

Download
memory/1448-48-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download
memory/1448-55-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download
memory/1448-69-0x00000251230C0000-0x00000251230C1000-memory.dmp

Filesize
4KB

Download
memory/1448-85-0x00000251230C0000-0x00000251230C1000-memory.dmp

Filesize
4KB

Download
memory/1448-173-0x0000025124990000-0x0000025125990000-memory.dmp

Filesize
16.0MB

Download