d43d793529aa53d452cc85badf97e5aa04fe09f61d99046c655a51b31709b624

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 03:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProgressTabs.jar
Size

3KB
MD5

40002c908163cd461313a676dd82d343
SHA1

0d31a64697ca79dc32c5f15b996236ff4239cd90
SHA256

c607953d9db6621d955eeecfdfd02938321f40d507b3a24db35d2b248cada82c
SHA512

c7c05af8898412bbb5011c163f99022e90d89a63d01caec49702ecdabb761f0696d009070ced3e8fd5d205fb5a591ddd708b25bb4e7760000ae95e164d7ae3e4

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1664 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 940 wrote to memory of 1664 940 java.exe icacls.exe
PID 940 wrote to memory of 1664 940 java.exe icacls.exe

pid	process
1664	icacls.exe

description	pid	process	target process
PID 940 wrote to memory of 1664	940	java.exe	icacls.exe
PID 940 wrote to memory of 1664	940	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ProgressTabs.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6a0030d1d47d6e013b479233621da1c0

SHA1
fda4b46e3b217295c065fd41134142b0b60d7eaa

SHA256
73c8dae9ff58a240d184d1f8f9b83fa46c960404eb9b1694dce974279f6a59de

SHA512
ef986d9d3dba779531686c8a0d2ea733cfa4682296755055f3b94449413733b328650bddfedd606a0905dfc02052d25dc35bb163070f5bc721c630ba86827576

Download Submit
memory/940-2-0x0000025824D90000-0x0000025825000000-memory.dmp

Filesize
2.4MB

Download
memory/940-12-0x0000025823460000-0x0000025823461000-memory.dmp

Filesize
4KB

Download
memory/940-13-0x0000025824D90000-0x0000025825000000-memory.dmp

Filesize
2.4MB

Download