00d1db0b29cae03c77c3d6d836f464f9210e21f20fe0b499e0f113d8300cbef9

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EzExploit B2.3/modules/cmd_alert.jar
Size

5KB
MD5

56416bffc290b5531375807e134053f4
SHA1

cc706ad8d6b9bf02154df232d1b9574b892afd2f
SHA256

785152401573f49a3b1d9a3cf50edb89b971acf0bff4f50c1ba93678b15e92cb
SHA512

e798017ac689d8cb4f9219b84d85896ac6852762efba859af5e7442b22bf0b81fcdb5e117342e7b309a4c0b7bfed8e0304669b1c70e565b69b05610852b45bb4
SSDEEP

96:n6H/zjSMnsoU6BuXvGLHvoWywguYPHbSDM9TH5Yvp:n6r+MskcXOLb0uYjSM5Yvp

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2032	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2032	3292	java.exe	90
PID 3292 wrote to memory of 2032	3292	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\EzExploit B2.3\modules\cmd_alert.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
494a7931f28fcb93f4ff246c15f110b1

SHA1
3981e8dbdd713fb5ebdb928e21ff77761bc64193

SHA256
9523dc6268b9fd82448caac7bc91cc8e53fc3cad340a959ea4b5aff0513f078a

SHA512
204db6fdbc67400390933939d3a08a11aa92c532363a7767d9432c98fe831d09ebea60c775b6aeba26c1e5da5a8a264486138be363215f52ecdcb104bed5c4b1

Download Submit
memory/3292-4-0x000002968C1E0000-0x000002968D1E0000-memory.dmp

Filesize
16.0MB

Download
memory/3292-12-0x000002968C1C0000-0x000002968C1C1000-memory.dmp

Filesize
4KB

Download