86be8c7da56e9ee77a379a1c4a0be388063b189280efe24bc20db9c7b6c7bc52

Resubmissions

22-05-2024 23:33

240522-3jvlssdc92 7

Analysis

max time kernel
35s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jars/NewLaunch.jar
Size

12KB
MD5

f6b999797a94f1a722ac600516d4e1ae
SHA1

3a22fd1b38b8129d9eeaaed6adc27b3e3d9f9d2b
SHA256

a82a3617fd83cc6fe77ee73475c62aeceb5f084665c434e8d8233d61b7b47480
SHA512

c06ec95eb60c1035f912b0ac453e3a0540b8e0836849d9f927009e4c84c33593a65c7c6a43c97541d56d265092a3ac748797d4f33d2ca9b5424974d0b046e89c
SSDEEP

192:KHsrTpvwANCSLz4EqenQCRcSqKql/EnlTBqV1ZpXRFXyIMXuHBeGnhV0nB/k:es/NCSLxqeP1FBa1ZXYSBeGek

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5012 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 4508 wrote to memory of 5012 4508 java.exe icacls.exe
PID 4508 wrote to memory of 5012 4508 java.exe icacls.exe

pid	process
5012	icacls.exe

description	pid	process	target process
PID 4508 wrote to memory of 5012	4508	java.exe	icacls.exe
PID 4508 wrote to memory of 5012	4508	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jars\NewLaunch.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
de59f0b566f6d703d7195adb18402197

SHA1
f2efc340f6f65ff6230f3370cb309d2da7cf24c7

SHA256
bccbe198fc346d094055337354c286e21f81ab70d62a8d758642f6ba0e56979a

SHA512
7019066a287c9309ad490063387f73e377f0dc6218a2e28436754c02240eb8c514b8e89b27911a455a71f9d87127b550a4fcd823b638f49688bd5545debb2cef

Download Submit
memory/4508-2-0x000002DF201E0000-0x000002DF20450000-memory.dmp

Filesize
2.4MB

Download
memory/4508-12-0x000002DF1E900000-0x000002DF1E901000-memory.dmp

Filesize
4KB

Download
memory/4508-14-0x000002DF201E0000-0x000002DF20450000-memory.dmp

Filesize
2.4MB

Download