31ee8b1f5a729087bfcd58265b4558d9c382736e74934a18200756ac672f6005

Analysis

max time kernel
88s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
02-05-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/slf4j-simple.jar
Size

14KB
MD5

722bb90689aecc523e3fe317e1f0984b
SHA1

8dacf9514f0c707cbbcdd6fd699e8940d42fb54e
SHA256

0966e86fffa5be52d3d9e7b89dd674d98a03eed0a454fbaf7c1bd9493bd9d874
SHA512

d5effbfa105bcd615e56ef983075c9ef0f52bcfdbefa3ce8cea9550f25b859e48b32f2ec9aa7a305c6611a3be5e0cde0d269588d9c2897ca987359b77213331d
SSDEEP

192:wyBOIrDL/vJ0RWNML2NyWKr362ByOikGnqO5Vyb3Uab+UtJIdgihtqSXs:wyBnxxMLg7KrqU7Gnqrb3lhtuF/qS8

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1888	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1888	240	java.exe	81
PID 240 wrote to memory of 1888	240	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\lib\slf4j-simple.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:240
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
57e4a6337a29ebc19693d3eba1d0dc37

SHA1
a87b31d1956542e74f093376f6dbd0cf286260d5

SHA256
6a542a81ccce571f5570166af9f74703c122062d2b7c0922bdfa46bf7dd582c3

SHA512
d49545752d9e624d7ad57f09d95ff5a2c1735614b3308a1a6399ab81c4cc6125d02644bcc9ed2d5d8003fb9cd49469ccb5e9b580c557f92edc195e0f1ca9d058

Download Submit
memory/240-2-0x0000023D9EC90000-0x0000023D9EF00000-memory.dmp

Filesize
2.4MB

Download
memory/240-12-0x0000023D9D4A0000-0x0000023D9D4A1000-memory.dmp

Filesize
4KB

Download
memory/240-13-0x0000023D9EC90000-0x0000023D9EF00000-memory.dmp

Filesize
2.4MB

Download