8bc4d422624113b2af547b64fa7df842b821f189ca4d7bad6e75767fec4a9e59

Analysis

max time kernel
75s
max time network
82s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
20-04-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar
Size

464KB
MD5

7e5e3d6d352025bd7f093c2d7f9b21ab
SHA1

ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57
SHA256

5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a
SHA512

c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad
SSDEEP

12288:pyfuv+DnikW2IfqFXKzNGNyyRmfD4vCgdiRST:pLWDnid2IfZGAyAfczdig

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4432 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 860 wrote to memory of 4432 860 java.exe icacls.exe
PID 860 wrote to memory of 4432 860 java.exe icacls.exe

pid	process
4432	icacls.exe

description	pid	process	target process
PID 860 wrote to memory of 4432	860	java.exe	icacls.exe
PID 860 wrote to memory of 4432	860	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\IIlIlIllIIlIIllIIllIIlIIIllIlIlIlIIIIlIlIllIIlIIllIIIIIllIIIIlIIIlIIlIIlIIlIllIIlllIIIllIIIlIIlIllllIllIIIIlIIIlIllllllI.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
d981b5c09d7308c4a3153d6308e7be12

SHA1
6f1502ed59dc5f4578e1ef3c24becc6eb8e54c36

SHA256
90ac6f042e17b718a44ddb4c4d0668ffd34a4b984c764f2734008915b51911b3

SHA512
fae5f9a2ae27b0945e7a794bf2eb6df998c6f7256f54171c9cdf73795967925b82a0bfc0245ed030358e8f8805a312395ea51f89001b2e4f8e52e155c89d1003

Download Submit
memory/860-4-0x00000171A58D0000-0x00000171A68D0000-memory.dmp

Filesize
16.0MB

Download
memory/860-12-0x00000171A58B0000-0x00000171A58B1000-memory.dmp

Filesize
4KB

Download