cd63f7e89dc90c13db43bc4cf30da197588fc32d815d8f92479e0c7d893c325c

Analysis

max time kernel
93s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c7745bd82a5a463e735702c384962cee9a24e545ae1c4a25048435635ff2301.jar
Size

4.4MB
MD5

69378ce7673351e66c1ee454839f41e0
SHA1

83fc571391b3b89810347cbc90276225b1344c96
SHA256

5c7745bd82a5a463e735702c384962cee9a24e545ae1c4a25048435635ff2301
SHA512

00bb0f58121a856d9c50217ffcd98f9084212ad8bc088441e843fe155a6bf21f94a8f4ee4006fa1118b4144c3c20e130b65e437c581a4877fc9a71a1f1a32f9d
SSDEEP

98304:GQYzfLUMW+NqE9QloL3qcKjyZVlZdoUylGEGOkAMsx:GTLJW+7zqPyzlZdoplEOkHsx

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3184	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 3184	1136	java.exe	84
PID 1136 wrote to memory of 3184	1136	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\5c7745bd82a5a463e735702c384962cee9a24e545ae1c4a25048435635ff2301.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f6dfbdff19507c9dc44a2b62b995237f

SHA1
f6c60c637b711181edb88c8da880d8d0c39b7081

SHA256
055f8b211fe8cd69e16887a3e893ae2ce610589897d9b3ab326c72270456cc82

SHA512
bd8302caaee8e68e5423b06ce67db65147b688d344d12c12b6e0f3604bd91adc4ea772bf31e72c5c699809f39e8216b9ff49ed6657a537fcf0ddc97fbd4e900b

Download Submit
memory/1136-4-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-12-0x000001819F4E0000-0x000001819F4E1000-memory.dmp

Filesize
4KB

Download
memory/1136-16-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-22-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-30-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-34-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-38-0x000001819F500000-0x00000181A0500000-memory.dmp

Filesize
16.0MB

Download
memory/1136-41-0x000001819F4E0000-0x000001819F4E1000-memory.dmp

Filesize
4KB

Download