b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
143s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/libraries/java/PackXZExtract.jar
Size 120KB
Sample240408-bgnxpaca9x
SHA256 a847432bdf7da12571bbd5bda3b11ca3664675d1ff9baad5abd59b2d0689fa93
MD5 cf8aa6c50804b3d2448b316b1cd24b17
SHA1 a69190724b20156dd17504162fbe771309415b73
SHA512 d897b843cf6d138885ffbcddcd53c84819bca0a1ac9de46334601d67fa9ba05d6b857b396a67b6f92e9f7745fce3f1a0402b76e4b31bd56d3cd36c339ac1e07c
SSDEEP 3072:4KKXNfoEU3hN7cOGhjVjRGreZHupS4uHAtS8X:bKip377EXGHqHAwG
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1472	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1472	2020	java.exe	91
PID 2020 wrote to memory of 1472	2020	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\resources\libraries\java\PackXZExtract.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b4d8618ec389fb6aa8119bd7b39421a555bdbe27f3896c2d25be829d6a3b2517
MD5 08502661f68274fc5c077370c39eadfc
SHA1 5a7d86cb378800bc60be9b4b32a04157189955ad
SHA512 68cdaaa8024b10036410a13e3c902441bfeb586945f06b4f8624b14b8ff93e8e21973a7311403f0e0aef875092bc69b4e4b63aed8a745d37bac723aa63bfb41a
MD5 SHA1 SHA512

Submit Download

memory/2020-4-0x000001A747740000-0x000001A748740000-memory.dmp

Download

memory/2020-12-0x000001A747720000-0x000001A747721000-memory.dmp

Download

memory/2020-14-0x000001A747740000-0x000001A748740000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads