Analysis
- max time kernel
31s - max time network
29s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
28/04/2024, 18:21
General
- Target PAYMENT 1567_0001.jar
- Size 5KB
- Sample240428-wzag8sdf92
- SHA256 b5ba14af96ed4c62864c7a6659bcbebae1988edd0907c649c36b6c4ef6b67be5
Malware Config
Signatures
- Modifies file permissions 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\PAYMENT 1567_0001.jar"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
3903daac9bc4a3b7.timestamp
memory/2208-34-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-12-0x000002F3410E0000-0x000002F3410E1000-memory.dmp
memory/2208-27-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-31-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-33-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-10-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-35-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-40-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-41-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-42-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-43-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-44-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-45-0x000002F3428F0000-0x000002F3438F0000-memory.dmp
memory/2208-47-0x000002F3428F0000-0x000002F3438F0000-memory.dmp