9d88971e966044a62ab0f65e6e479675a9b5a25f1daf9b831256915f8524801e

Analysis

max time kernel
55s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugins/power.jar
Size

11KB
MD5

cdc01ec1abee702c535da143fb3947d9
SHA1

0f73e2cf797ee4b25a73bc6f78cfd7d41952d294
SHA256

26db4a54482189dc989e59734318d5c12d656183d5394fe3c0fe5b33313cb785
SHA512

72c26a50a1f1ab9712808a218cf8026c6540fbe6ebc28eb3fee3eddf011f8566e82446630731a559c2ad0ca684be486bd991fc46149f6412ac692218e4e1d354
SSDEEP

192:W5aTR3/R61EZoMxX7GQyJ7UlcOgUN/5/9a1bN/:6c61PWX7a70V7N/R92R

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1060	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1060	1460	java.exe	85
PID 1460 wrote to memory of 1060	1460	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\plugins\power.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
8c770d495ddd978f56fbf52d7e8fb937

SHA1
6465750a32f380cc7152696da8239bdc850e5435

SHA256
3e60c90800799ac0f5a50d8e8ceb27f59dac0000dfb909ca4e0a56ba5ec5edac

SHA512
12926d1a06670d48bc642be37024ab95bede5e9da147221916e7c93aa12f3ffc9d4c74e7425d67982c40857f6bd7b7e3c3dacbefd66d30d2b0fde04db1e1bc64

Download Submit
memory/1460-8-0x000002A11EE00000-0x000002A11FE00000-memory.dmp

Filesize
16.0MB

Download
memory/1460-11-0x000002A11EDE0000-0x000002A11EDE1000-memory.dmp

Filesize
4KB

Download
memory/1460-13-0x000002A11EE00000-0x000002A11FE00000-memory.dmp

Filesize
16.0MB

Download