00d1db0b29cae03c77c3d6d836f464f9210e21f20fe0b499e0f113d8300cbef9

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EzExploit B2.3/modules/cmd_list.jar
Size

4KB
MD5

355849a62628d973a7bbc8c2505e805a
SHA1

e7bab7fb96f13c3f007c5d89129d804b5ebe50b8
SHA256

f4e62e6285ea6812a02495f31b9c2f7d3ebe753973b8a9f9ccab2f7b3016ab1d
SHA512

e58000192f0c19157b4d3a3683ba07ffdb391a45467c94388953589bbad3fe447403edb147fc0ac1ef3b97779142cda0f578e33e6543392fb8161f942815ff06
SSDEEP

48:v6H3giVY5igTuykeTZygXXzw/RY8j8fWb9M99Cfrn0o9SEuCVETGUVWf5P7BZf2r:v6HvVU7zJT0y8S9960zqUW5P77fj6f

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1468	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1468	1644	java.exe	87
PID 1644 wrote to memory of 1468	1644	java.exe	87

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\EzExploit B2.3\modules\cmd_list.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4059bd43a64492a8ab880b16ce954ebb

SHA1
6e056eaba6a7e9ce9abee55c840d329f067de017

SHA256
31ecc7d890144e4590965aad7587871aaf66e23ee86df7e3cd0311409111bc0d

SHA512
4055cf0fc4efb61ea9d594190bf4d0ad127bdcf30e24acb2dbed54d92d11ad79310ec82a9539cf08027312e316134d45e11b3fe4e8ed9284fcd2a2daae04c8c1

Download Submit
memory/1644-4-0x0000021781A90000-0x0000021782A90000-memory.dmp

Filesize
16.0MB

Download
memory/1644-11-0x0000021781A70000-0x0000021781A71000-memory.dmp

Filesize
4KB

Download
memory/1644-13-0x0000021781A90000-0x0000021782A90000-memory.dmp

Filesize
16.0MB

Download