a51dd83fb2f8ab618515855475f83188b18872db105b624ec4f40a444e09e818

Analysis

max time kernel
92s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240412-uk
resource tags

arch:x64arch:x86image:win10v2004-20240412-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
15-04-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Size

3KB
MD5

d9c23d7574c0d886321dcd029e463f2c
SHA1

7fad47eb6860a01325c6d526a43d9bbadb66aff7
SHA256

e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed
SHA512

c32c019fb0bacbd70441cf3ed769bfde9597389f840ff8511db36586756382ef22bd163a7b7cb9e258a4b7a896e5d1a606d92513a141cb2e3c6e421a66ecb316

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5628 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 2516 wrote to memory of 5628 2516 java.exe icacls.exe
PID 2516 wrote to memory of 5628 2516 java.exe icacls.exe

pid	process
5628	icacls.exe

description	pid	process	target process
PID 2516 wrote to memory of 5628	2516	java.exe	icacls.exe
PID 2516 wrote to memory of 5628	2516	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\Resources\Imports\PlayerJava\PlayerJava.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:5628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
094defb1ac747e06ed83bb7224e902ba

SHA1
0925e2cd7653020fbe2c5dc287d5ff8221243702

SHA256
a8be1d1c211be9683b6e262a11d3c2b9ee2dea528ae0cfc802adfdfc55435df7

SHA512
5803d993d7dc5e0af8f93c90059854d853431e83ca6ba5f7d3b5a884ef606f04531ae015abe92918bc33c5ac215ac6759a3a2f6debb6c12808e690e8033fb315

Download Submit
memory/2516-4-0x000002BB1BA60000-0x000002BB1CA60000-memory.dmp

Filesize
16.0MB

Download
memory/2516-13-0x000002BB1A290000-0x000002BB1A291000-memory.dmp

Filesize
4KB

Download