fbff2ebba99bfa194af533852062c6d60831c7cc3801d4af980c329721484a28

Resubmissions

14/05/2024, 18:01

240514-wl6crahe95 7

14/05/2024, 17:59

240514-wk2ceagh71 7

Analysis

max time kernel
35s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aristois-Free.jar
Size

6.6MB
MD5

4cad86ed173ff0dad198582d86bf62b6
SHA1

d25bd59b411076ccc1ed4b4daef78aef093a9d3d
SHA256

fbff2ebba99bfa194af533852062c6d60831c7cc3801d4af980c329721484a28
SHA512

e233c3ba1b3aeab0e286ad46e7ac4f34ae2207269c7a624bc29d90f14e6ff2dac4d74785414966569ab8da0b2d65d591eadd8884c1989976c361b5ff0c87aea2
SSDEEP

196608:N0EY4XwEff0cxykwL9g1leOnAU+1blTRLXKrC05:KYDf8FkHXAU8dJXKrb5

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1540	java.exe
1540	java.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3400	icacls.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	java.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 3400	1540	java.exe	83
PID 1540 wrote to memory of 3400	1540	java.exe	83

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Aristois-Free.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4569c47429c5ab4243194ad7305bdd64

SHA1
84570e35e2cf7a29ab4c4d279eaf59c78a7fe21b

SHA256
59f2747abae5f2e2c9c82c037a57082a2d4ab7be2ad745af72a98fa9d0eb85e8

SHA512
9a5e51a3b09c64ebbb9f5ec9ce14781b632cefebad1fbeee72078eb433a8ceaf9fea6550d1ded9a71659379e5e9a59ee704a12022315cc9fee87711f280d5137

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwjglAdmin\3.3.1-SNAPSHOT\glfw.dll

Filesize
357KB

MD5
dad976fafd111ceedc7a473932e9da8f

SHA1
3c0e8e7fcbc854a87219fbbfd181c2cc76018144

SHA256
f61949c469c54a5f4e5a8e1668255b919ee1237f1e568acf4127dda0abcdc9a8

SHA512
64801d4d34f130b5ee33d2df3a266e2aed981265d13c6552ab73418471398c49cab9a617647b64298c1de432d078f1a7b830d4330980e7ef10dd15a1d18bda11

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwjglAdmin\3.3.1-SNAPSHOT\lwjgl.dll

Filesize
446KB

MD5
78b8212a157e985fa9d9ee9eaab033bd

SHA1
0c9b501520c20055ba77bbd8cae4895fcb1cfa40

SHA256
1cbc8a197aea7eee710735a57a8cae6c0953ad1fe2cb6e17c2e5afebeb93b5ec

SHA512
180dd20b04643d42195a30c28d455c923f395977f7dcb66b1ace85e99c1e3c00906542221092bf6d5465a5fc451d7523df862ab2bc050da3a136a6f635706d80

Download Submit
memory/1540-2-0x0000028C00000000-0x0000028C00270000-memory.dmp

Filesize
2.4MB

Download
memory/1540-13-0x0000028C00270000-0x0000028C00280000-memory.dmp

Filesize
64KB

Download
memory/1540-15-0x0000028C00280000-0x0000028C00290000-memory.dmp

Filesize
64KB

Download
memory/1540-17-0x0000028C00290000-0x0000028C002A0000-memory.dmp

Filesize
64KB

Download
memory/1540-19-0x0000028C002A0000-0x0000028C002B0000-memory.dmp

Filesize
64KB

Download
memory/1540-21-0x0000028C002B0000-0x0000028C002C0000-memory.dmp

Filesize
64KB

Download
memory/1540-24-0x0000028C002C0000-0x0000028C002D0000-memory.dmp

Filesize
64KB

Download
memory/1540-25-0x0000028C002D0000-0x0000028C002E0000-memory.dmp

Filesize
64KB

Download
memory/1540-27-0x0000028C002E0000-0x0000028C002F0000-memory.dmp

Filesize
64KB

Download
memory/1540-29-0x0000028C002F0000-0x0000028C00300000-memory.dmp

Filesize
64KB

Download
memory/1540-33-0x0000028C00300000-0x0000028C00310000-memory.dmp

Filesize
64KB

Download
memory/1540-32-0x0000028C00000000-0x0000028C00270000-memory.dmp

Filesize
2.4MB

Download
memory/1540-35-0x0000028C00270000-0x0000028C00280000-memory.dmp

Filesize
64KB

Download
memory/1540-34-0x0000028C00310000-0x0000028C00320000-memory.dmp

Filesize
64KB

Download
memory/1540-38-0x0000028C00320000-0x0000028C00330000-memory.dmp

Filesize
64KB

Download
memory/1540-37-0x0000028C00280000-0x0000028C00290000-memory.dmp

Filesize
64KB

Download
memory/1540-40-0x0000028C7A110000-0x0000028C7A111000-memory.dmp

Filesize
4KB

Download
memory/1540-43-0x0000028C00330000-0x0000028C00340000-memory.dmp

Filesize
64KB

Download
memory/1540-42-0x0000028C00290000-0x0000028C002A0000-memory.dmp

Filesize
64KB

Download
memory/1540-46-0x0000028C00340000-0x0000028C00350000-memory.dmp

Filesize
64KB

Download
memory/1540-45-0x0000028C002A0000-0x0000028C002B0000-memory.dmp

Filesize
64KB

Download
memory/1540-48-0x0000028C00350000-0x0000028C00360000-memory.dmp

Filesize
64KB

Download
memory/1540-47-0x0000028C002B0000-0x0000028C002C0000-memory.dmp

Filesize
64KB

Download
memory/1540-51-0x0000028C002C0000-0x0000028C002D0000-memory.dmp

Filesize
64KB

Download
memory/1540-52-0x0000028C00360000-0x0000028C00370000-memory.dmp

Filesize
64KB

Download
memory/1540-56-0x0000028C00370000-0x0000028C00380000-memory.dmp

Filesize
64KB

Download
memory/1540-55-0x0000028C002D0000-0x0000028C002E0000-memory.dmp

Filesize
64KB

Download
memory/1540-59-0x0000028C00380000-0x0000028C00390000-memory.dmp

Filesize
64KB

Download
memory/1540-58-0x0000028C002E0000-0x0000028C002F0000-memory.dmp

Filesize
64KB

Download
memory/1540-69-0x0000028C00390000-0x0000028C003A0000-memory.dmp

Filesize
64KB

Download
memory/1540-68-0x0000028C002F0000-0x0000028C00300000-memory.dmp

Filesize
64KB

Download
memory/1540-79-0x0000028C7A110000-0x0000028C7A111000-memory.dmp

Filesize
4KB

Download
memory/1540-80-0x0000028C00310000-0x0000028C00320000-memory.dmp

Filesize
64KB

Download
memory/1540-81-0x0000028C00270000-0x0000028C00280000-memory.dmp

Filesize
64KB

Download
memory/1540-87-0x0000028C00300000-0x0000028C00310000-memory.dmp

Filesize
64KB

Download
memory/1540-86-0x0000028C002C0000-0x0000028C002D0000-memory.dmp

Filesize
64KB

Download
memory/1540-85-0x0000028C002B0000-0x0000028C002C0000-memory.dmp

Filesize
64KB

Download
memory/1540-84-0x0000028C002A0000-0x0000028C002B0000-memory.dmp

Filesize
64KB

Download
memory/1540-83-0x0000028C00290000-0x0000028C002A0000-memory.dmp

Filesize
64KB

Download
memory/1540-82-0x0000028C00280000-0x0000028C00290000-memory.dmp

Filesize
64KB

Download
memory/1540-88-0x0000028C00000000-0x0000028C00270000-memory.dmp

Filesize
2.4MB

Download
memory/1540-96-0x0000028C00390000-0x0000028C003A0000-memory.dmp

Filesize
64KB

Download
memory/1540-95-0x0000028C00380000-0x0000028C00390000-memory.dmp

Filesize
64KB

Download
memory/1540-94-0x0000028C00370000-0x0000028C00380000-memory.dmp

Filesize
64KB

Download
memory/1540-93-0x0000028C00360000-0x0000028C00370000-memory.dmp

Filesize
64KB

Download
memory/1540-92-0x0000028C00350000-0x0000028C00360000-memory.dmp

Filesize
64KB

Download
memory/1540-91-0x0000028C00340000-0x0000028C00350000-memory.dmp

Filesize
64KB

Download
memory/1540-90-0x0000028C00330000-0x0000028C00340000-memory.dmp

Filesize
64KB

Download
memory/1540-89-0x0000028C00320000-0x0000028C00330000-memory.dmp

Filesize
64KB

Download