9d88971e966044a62ab0f65e6e479675a9b5a25f1daf9b831256915f8524801e

Analysis

max time kernel
66s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

plugins/hideme.jar
Size

7KB
MD5

cdab6a30b0949a741f13935f5483c303
SHA1

729d00e4fa04ca49c00b5b6aa60706dfadd5644e
SHA256

fa14c735ab9fed3f3a5df0dc78a5d38ae0a146099ddc858197e9f528bd996c40
SHA512

bf155c0b062fe9c7c237f9b0329a155387b7294fae7c7ed73e41e9528f119ccc513855329f6e91e62106b589c8b215d981ed11f2f89c7e13c06fbdcf7d6d1ee8
SSDEEP

96:ohFTqRYuFhXQ5GeiCGkeFUgbH44yY8NVFubQLwNUmvHh18OiPKwChme:gFuRDiiCSbH4u8ZuvOMBGOiEme

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4612	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 4612	3920	java.exe	85
PID 3920 wrote to memory of 4612	3920	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\plugins\hideme.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
7de45e5fdd3f46195f926d9a6b63ef7c

SHA1
ff7436edd47f4750b1a377fbcfd5315129411006

SHA256
640366d722ce376571f299fa1652c10febdb845a5ae1e5d44243f14989ee893d

SHA512
ce8e0e7caa977e3d2a20d60a57edd9e5ea283bb0efae1d62136a2f49e76871aebdaaceca6823737e9e7474de5fef398a66a4bbadae6de314089c31dbaf62c764

Download Submit
memory/3920-10-0x000001C03A1C0000-0x000001C03A1C1000-memory.dmp

Filesize
4KB

Download
memory/3920-12-0x000001C03B9D0000-0x000001C03C9D0000-memory.dmp

Filesize
16.0MB

Download
memory/3920-13-0x000001C03B9D0000-0x000001C03C9D0000-memory.dmp

Filesize
16.0MB

Download