ab673d01526a2638fc3080ae32bfbc4d903add09dbc23d2cc26c2e692a62b604

Analysis

max time kernel
66s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
018e4debaa5d4f10530bc5753c003751_JaffaCakes118.jar
Size 532KB
Sample240426-ystnmsca41
SHA256 ab673d01526a2638fc3080ae32bfbc4d903add09dbc23d2cc26c2e692a62b604
MD5 018e4debaa5d4f10530bc5753c003751
SHA1 7f19dda598844702aaa574d27cedd2c6e9ed0a46
SHA512 3b14e8399d265d3432b92e80d0a0e4464d26b7f524edc046e2995b672361500d34c6b492f72f8282dd2daa16e1a777d4b7e58e711909a1bacc6049f620f7b580
SSDEEP 12288:kAe6FU7Ki7Tpic1KE/OD63KGhv94jkl8yzUtI/y54:kAeGwdphk0ODb64G/1
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
984	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 984	2112	java.exe	84
PID 2112 wrote to memory of 984	2112	java.exe	84
PID 2112 wrote to memory of 4876	2112	java.exe	89
PID 2112 wrote to memory of 4876	2112	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\018e4debaa5d4f10530bc5753c003751_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:984
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.7072338034098639444194747335010462.class
  2⤵
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 afbde086b9a0780dfae3efaf49649be83371e84018f872699a85fbb2bdde6de6
MD5 6632361160cf7193c884a182636e4d12
SHA1 a75808b98a05cdbea4e0ee8548c73a67a453769e
SHA512 6973379438e614518ff306c480e5b4472cff090c1cf1a96a449a3d445b3b5a78163d17c028e8c4f3fdbc74652970e972d407528dcdc858375293c7bc699b1501
MD5 SHA1 SHA512

Submit Download

_0.7072338034098639444194747335010462.class

Path C:\Users\Admin\AppData\Local\Temp\_0.7072338034098639444194747335010462.class
Size 241KB
SHA256 97d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
MD5 781fb531354d6f291f1ccab48da6d39f
SHA1 9ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA512 3e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
SSDEEP 6144:WI5pxUZ7Gvi8ulm+yV/rIF0/MO2qnan1J7pXESN6U:J5pxAGqNkrIq/MO2qnA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2112-21-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-10-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-33-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-34-0x000002F8A23B0000-0x000002F8A23B1000-memory.dmp

Download

memory/2112-35-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-36-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-37-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-12-0x000002F8A23B0000-0x000002F8A23B1000-memory.dmp

Download

memory/2112-47-0x000002F8A23B0000-0x000002F8A23B1000-memory.dmp

Download

memory/2112-49-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/2112-50-0x000002F8A3B80000-0x000002F8A4B80000-memory.dmp

Download

memory/4876-48-0x000002926B280000-0x000002926B4F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads