eecbb9d50663e28777057e83cb5f82cd10e405438ee7cc27f17e880767111377

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 10:49

Target

Pedido N°2024-08-0004_pdf.jar
Size

218KB
MD5

f2d80c038d90b222e05e229ecde3527a
SHA1

2b97fcf8172da5829216fca04de13c0f66744cd1
SHA256

eecbb9d50663e28777057e83cb5f82cd10e405438ee7cc27f17e880767111377
SHA512

f3f0f7b95b01ab5231ba5559b05ab433a5f5079c6c490be8f58bb67cc38898f45322d6b30b5c2ad393c89fb7d136aee8c13340d123998dd77f589d97177251f9
SSDEEP

6144:E2aXQ9rZEKIq1yvksjXoMYl29KTyudyTCYKjmEL:4wlIqAvks7GqcsTymM

Score

7^/10

discovery

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4644 icacls.exe

pid	process
4644	icacls.exe

Drops file in Program Files directory 12 IoCs

Processes:

java.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	java.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4388 wrote to memory of 4644 4388 java.exe icacls.exe
PID 4388 wrote to memory of 4644 4388 java.exe icacls.exe

description	pid	process	target process
PID 4388 wrote to memory of 4644	4388	java.exe	icacls.exe
PID 4388 wrote to memory of 4644	4388	java.exe	icacls.exe

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4644

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
1ce2ba09f95c0b6d68f8b808c35c8a8c

SHA1
e289e3ae4df00258e2b3d4eb4ed75dd277367df5

SHA256
1816add2963eef6d657f3e605fa4bdbbd2dffdf107d06dabd8ee33561678366c

SHA512
52d0391534f664a3045e42f65cca30a5796198ed65216bfdc1cc6d5c04e6de596830d73b6ca9fa71cfc6eddfe3ee2bcddc7dafd4eee146a8956cf9dc92e6b211

Download Submit
memory/4388-4-0x0000028EC2EC0000-0x0000028EC3EC0000-memory.dmp

Filesize
16.0MB

Download
memory/4388-12-0x0000028EC15D0000-0x0000028EC15D1000-memory.dmp

Filesize
4KB

Download
memory/4388-18-0x0000028EC2EC0000-0x0000028EC3EC0000-memory.dmp

Filesize
16.0MB

Download
memory/4388-20-0x0000028EC3140000-0x0000028EC3150000-memory.dmp

Filesize
64KB

Download
memory/4388-21-0x0000028EC3150000-0x0000028EC3160000-memory.dmp

Filesize
64KB

Download
memory/4388-22-0x0000028EC2EC0000-0x0000028EC3EC0000-memory.dmp

Filesize
16.0MB

Download