3b077d3e99eb714d13e76826d75929807e8ab582023c59bc405d4bad67193254

Analysis

max time kernel
444s
max time network
1163s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ctjs-2.2.0-1.8.9.jar
Size

3.9MB
MD5

c1c9dc0c562a8ea027166f1efcd85b24
SHA1

691cd64f30def1c5573e4ee67a7b9914700454ea
SHA256

3b077d3e99eb714d13e76826d75929807e8ab582023c59bc405d4bad67193254
SHA512

7688bc0cda041f38d19e8dd02ecd50db8ecd3f7cbfeba800fbcf20814179eef457903d242b1c804bd2cae00a5b217a3566aeafdaffa12c97023d8fc167c5ed30
SSDEEP

98304:373kvjlv6LdoC8UZK0LqyIRX9lK0K2E6mqLp5anIB:Lk6LFPARNl7xE6pL3Co

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3268 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3260 wrote to memory of 3268 3260 java.exe icacls.exe
PID 3260 wrote to memory of 3268 3260 java.exe icacls.exe

pid	process
3268	icacls.exe

description	pid	process	target process
PID 3260 wrote to memory of 3268	3260	java.exe	icacls.exe
PID 3260 wrote to memory of 3268	3260	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ctjs-2.2.0-1.8.9.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
a39c23ffcd563147d036974747034fbd

SHA1
faf812d8116a522a659f89f809cffc6b1260f562

SHA256
7fc5184196f46e02a55fa0186dd780baeb26b5193f726b29a1afc96a657b90e2

SHA512
6af0e0b044c773aed3da66e8d6841ec1fe203e9ce30baae297641ae948f881005b9301d4eb051451be43809f07c0a6d0f9e9b55383cdb41da4aa3e71138fd75c

Download Submit
memory/3260-2-0x000001EE00000000-0x000001EE00270000-memory.dmp

Filesize
2.4MB

Download
memory/3260-12-0x000001EE72AA0000-0x000001EE72AA1000-memory.dmp

Filesize
4KB

Download
memory/3260-13-0x000001EE00000000-0x000001EE00270000-memory.dmp

Filesize
2.4MB

Download