99a4bbb544d59c2f390a63117f0b08be0787d404d1bb74c7deeabef855557691

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TooGood4U.jar
Size 12.3MB
Sample240507-bcnfcsbc4z
SHA256 99a4bbb544d59c2f390a63117f0b08be0787d404d1bb74c7deeabef855557691
MD5 c2dffe211a2c242aabe43beb98b575ee
SHA1 21c3ea76957ff281fc1462f0ad6adb115827d054
SHA512 ccde618118961693bddb32523f013f8b7caa091ceee818beccf5e859bb7c1a6a792e56dd6ed646e068ca5c1c63b6efa040a5e0e1d67e8801954fd9b08af98e41
SSDEEP 196608:L7ThXWzBWbYaFYIooLbH4arcRcrJLG/VahJDRcHyGF8zIKopn2UDSL9cFkfzZXsH:HThWWqy0vRMzuHy99UuL9rLZYULv7i
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2804	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 2804	3192	java.exe	84
PID 3192 wrote to memory of 2804	3192	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\TooGood4U.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 99fac5af1410c1685bdf26a46ad05030f6988cc12fa49791817b375930e7bfbe
MD5 8d4ddb6d9fc5792abdbd8a4d6c7af5c9
SHA1 0e8c7779923a8c25c09436a0e4705304bbb16642
SHA512 ab2099350a57a1b4618aed48055745aa2fa22b11fedc1f1abd9d8dbb3b9486a7c0a87b78aa4f102bc562a117e204e08f72b4493a82f90c0f2ba126a7dba3f207
MD5 SHA1 SHA512

Submit Download

memory/3192-2-0x0000017B9A380000-0x0000017B9A5F0000-memory.dmp

Download

memory/3192-13-0x0000017B9A360000-0x0000017B9A361000-memory.dmp

Download

memory/3192-14-0x0000017B9A380000-0x0000017B9A5F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads