bd56fe7e441234f09d3b22dad753224901231fd2fd231ba0d40b917e964b9385

Analysis

max time kernel
55s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

GumTuneClient-0.7.0.jar
Size

403KB
MD5

d1bf914934d6c47320ad5a423530160a
SHA1

b7429ba804cfe16fef9551ea4066d8ed9b8a8861
SHA256

bd56fe7e441234f09d3b22dad753224901231fd2fd231ba0d40b917e964b9385
SHA512

6bf70b82fcdb910e2ece7b5031495105323b3c90639691398d55eb684f42b5f0ec804c3c9be849e76f35bc225a70f2afcca8b22aa75739c2af05e2736a6dcdd0
SSDEEP

6144:GlAkFUQklaEvRCfvR/j7PwUIhMFd3aZ3Fno6D4YiVZvuyt5A8DmDvAwV13nCYLcp:yhFWX8vR/3YUIno6D4YCvuyt5QVRrc5P

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
380	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 380	4436	java.exe	86
PID 4436 wrote to memory of 380	4436	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\GumTuneClient-0.7.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
52b3045a6be83da82ac64ecfbcd8d098

SHA1
7dc612d68ace0ca46686e0dd5ca4d95d2452125c

SHA256
6bc40a397f0faf9a7ad14e8bdda009c2fe67a368d496b0a69b24a7be0bcf423c

SHA512
eae3467c62021ffa0486187b2414280d59ab96fa0c430177b799adca181fd116e3d76e20658bc77320b0bf409283ce197f8c467e6e80b057f8cb32595282eadb

Download Submit
memory/4436-10-0x000002626C420000-0x000002626D420000-memory.dmp

Filesize
16.0MB

Download
memory/4436-11-0x000002626AB60000-0x000002626AB61000-memory.dmp

Filesize
4KB

Download
memory/4436-13-0x000002626C420000-0x000002626D420000-memory.dmp

Filesize
16.0MB

Download