87f72b2cb5677b04b8ee86bd4951990b9e528a5cf87a6935154d99c383358089

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 17:23

Target

be46717a2f3f17793a9d9fa12d0bd417_JaffaCakes118.jar
Size

397KB
MD5

be46717a2f3f17793a9d9fa12d0bd417
SHA1

ff1201927fb0feedb614dba9e4ffe9e58ef91ac8
SHA256

87f72b2cb5677b04b8ee86bd4951990b9e528a5cf87a6935154d99c383358089
SHA512

989fd25def933eeda01f20d519dd448d30e3f0cd581d941332241760c3d2e4c13247254f38a133f8a28bfa4b6da6127f399482169412588f22f5b5dce0e09929
SSDEEP

12288:vYjUsuboVArx55DClCP+jp42GsThJUaz5jU+rLuB:QjUptrx5FClCYNG65zJL/I

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2284 icacls.exe

pid	process
2284	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1500 wrote to memory of 2284 1500 java.exe icacls.exe
PID 1500 wrote to memory of 2284 1500 java.exe icacls.exe

description	pid	process	target process
PID 1500 wrote to memory of 2284	1500	java.exe	icacls.exe
PID 1500 wrote to memory of 2284	1500	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\be46717a2f3f17793a9d9fa12d0bd417_JaffaCakes118.jar
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2284

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f02f02296712952fa02afec0dd4b4f74

SHA1
82f4037a06e7df90911fa0e6a9c6f48789af3585

SHA256
59450aca9af3173b3603b12d9449e036eb308dd4ed35eade49bb40ad4d0391d9

SHA512
51688c7ba7cfcd724f947a47202089332e1f1b0e793c42bb82a393daf1ea45a53df22b2284b9a89bfc9be036cb07e9528ad9756ec46b25c295e373f128e072db

Download Submit
memory/1500-5-0x0000027015760000-0x0000027016760000-memory.dmp

Filesize
16.0MB

Download
memory/1500-12-0x0000027013E80000-0x0000027013E81000-memory.dmp

Filesize
4KB

Download
memory/1500-18-0x00000270159E0000-0x00000270159F0000-memory.dmp

Filesize
64KB

Download
memory/1500-19-0x0000027015760000-0x0000027016760000-memory.dmp

Filesize
16.0MB

Download
memory/1500-20-0x0000027015760000-0x0000027016760000-memory.dmp

Filesize
16.0MB

Download