31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
141s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/gson.jar
Size

226KB
MD5

5134a2350f58890ffb9db0b40047195d
SHA1

751f548c85fa49f330cecbb1875893f971b33c4e
SHA256

2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32
SHA512

c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a
SSDEEP

3072:2DiL6hR+wm60gqZjJhqo2M04r7bv1XMrMxw1rl1rwj+Bmd6dYBmkW1eIjEmFdbl6:bq0jSi2Qi1B1Cay6dYBUwmPxLe3

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1464	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 1464	4936	java.exe	79
PID 4936 wrote to memory of 1464	4936	java.exe	79

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\gson.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4f611bcb937a774991fda7433de4ea8c

SHA1
e408c24b9cc18d05b3e4c7431df364780a649e5b

SHA256
951902425701564dc5037b90a5bf57b287027c30e6e2c8b8688013f62f2f543b

SHA512
d299a60efd47056a053105e6e170c46973b628daae62b25d9b41b4d50f93d7723ca87d07f22aa55ef44f9dd017b8d398c2909ae3a11222fbe8d15d4ec927de90

Download Submit
memory/4936-2-0x0000021AE65A0000-0x0000021AE6810000-memory.dmp

Filesize
2.4MB

Download
memory/4936-12-0x0000021AE4CA0000-0x0000021AE4CA1000-memory.dmp

Filesize
4KB

Download
memory/4936-13-0x0000021AE65A0000-0x0000021AE6810000-memory.dmp

Filesize
2.4MB

Download