c2fc663f23d734380807de7b7f5897376cdc1e3cd547d51ab515a3a4e72ab073

Analysis

max time kernel
1176s
max time network
1178s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunch.jar
Size

13KB
MD5

b7c74c310eefc0b4a85cc8c8f4e38216
SHA1

a482ba756bd06d45e34e17f71ff570be83a203ad
SHA256

d74add64df7329bc0bb16491117fb17c65676ed80df1ab75166d13381ff85bba
SHA512

e2d33dc6730a913a3126a9fe41a55b93623e8f263c6af290f96e392f2b00683663a38d729696b772f0fcfbbc61c0f36b5e5ac1ff5a441ce16b19078ac2509a2d
SSDEEP

192:TIFF8voDNpApTranKql6tnlTobcjXvXR0Xy+jjquGBeGnhECnsE:cFF8QJpARrHFVDBeGUE

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2324 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 760 wrote to memory of 2324 760 java.exe icacls.exe
PID 760 wrote to memory of 2324 760 java.exe icacls.exe

pid	process
2324	icacls.exe

description	pid	process	target process
PID 760 wrote to memory of 2324	760	java.exe	icacls.exe
PID 760 wrote to memory of 2324	760	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
436053d5783a90cddf831fc5ea7722b4

SHA1
29d7cc398b09a9f2628b0c4064675bb1a9c1f1e7

SHA256
e51ef3f1931ea7282d283ae30eadf763ef9e9e674aa8a9430b634850403b9c39

SHA512
8eeaab84a94f86b01e5b5bbf33a8f742e3c639df86811a024c5a9ec284cd47d8ee7b6cbda9244a356dfa722fedbee4270d308e6c3a4306ba608563af470b2e81

Download Submit
memory/760-10-0x0000021254430000-0x0000021255430000-memory.dmp

Filesize
16.0MB

Download
memory/760-12-0x0000021252B60000-0x0000021252B61000-memory.dmp

Filesize
4KB

Download
memory/760-14-0x0000021254430000-0x0000021255430000-memory.dmp

Filesize
16.0MB

Download