31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
144s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/jsoup.jar
Size

342KB
MD5

36145fee38e79b81035787f1be296a52
SHA1

33ee82e324f4b1e40167f3dc5e01234a1c5cab61
SHA256

6ebe6abd7775c10a49407ae22db45c840cd2cdaf715866a5b0b5af70941c3f4a
SHA512

3b00b07320831f075a6af9ac1863b8756fe4f99a1b4f2e53578dca17fdaf7bdb147279225045e9eeeba4898fe321cf5457832b8e6a1a5b71acff9a1c10392659
SSDEEP

6144:C12HHimPXaabXTLqQt/ujrjUqGSEzZn/K0qeW79ix6vEF0FYqPfW:CCx3bXTGoGvJGSCtqeyIovECdPfW

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3568	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 3568	1120	java.exe	81
PID 1120 wrote to memory of 3568	1120	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\jsoup.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
35866f39dfafa3cdd6d9e68ef977ab45

SHA1
476fbcb3ffb928f1ef62bdfb7cfa0595dabdd667

SHA256
f94fcf1611030e91dab1afe487fb79aa970cd6c03bc00ad85adbf784621ea32b

SHA512
a0f3d8832b009469764999192da40e51d268d78f420bed0d8111f1854018b5f990b8b39b800b1963d7a2ed45edc7a1b903967845083f20aa64641e853aaafed5

Download Submit
memory/1120-2-0x0000018CA6990000-0x0000018CA6C00000-memory.dmp

Filesize
2.4MB

Download
memory/1120-12-0x0000018CA6970000-0x0000018CA6971000-memory.dmp

Filesize
4KB

Download
memory/1120-13-0x0000018CA6990000-0x0000018CA6C00000-memory.dmp

Filesize
2.4MB

Download