2bfeadee59ab1988c336dbd6e65d991f766ae1dd8683f2a6ded5faa0279f0ca0

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
08-04-2024 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kotlin-compiler-embeddable-1.9.22.jar
Size

57.4MB
MD5

0da92ab0aea48f14caf8c09062c277ce
SHA1

9cd4dc7773cf2a99ecd961a88fbbc9a2da3fb5e1
SHA256

2bfeadee59ab1988c336dbd6e65d991f766ae1dd8683f2a6ded5faa0279f0ca0
SHA512

0d597c1758d00cfaaf8468e251ec9aeb3ec7648d082c3642ba966754e4e1d17776f8bc90b954cc936cde59c9c1298a17297d58c0551e0150b9f1ed55b8b776a1
SSDEEP

1572864:EJAdgf/7wuV5CVvuR02M7Ld956OGfVoFQWKPa:E7ruGKlhFZKPa

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1148	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 1148	2396	java.exe	94
PID 2396 wrote to memory of 1148	2396	java.exe	94

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\kotlin-compiler-embeddable-1.9.22.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4116 --field-trial-handle=2244,i,861925222566734100,5228329984880658054,262144 --variations-seed-version /prefetch:8
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d46600be62bfc37e0d4c32ffb2f43b8c

SHA1
c9e4ce61db374a30bf4961267e5ab164abe0b5bd

SHA256
f9c1a8edb095f1e4f7f46ff750e9d50d8c7941ee84ce32b146aa5d375ee5c6dd

SHA512
42f26d08c9d82cabe8812e354ec29c7e36487bb6b859401907e4eb253fd4e9722d51fb7676096e17453f4d8e3bcd044ee593dff8a95bc1a94f24079ba0dd8511

Download Submit
memory/2396-3-0x000001760FA80000-0x0000017610A80000-memory.dmp

Filesize
16.0MB

Download
memory/2396-12-0x000001760FA60000-0x000001760FA61000-memory.dmp

Filesize
4KB

Download