acc1a4db9132fc20171811b4f020ac461874d93be33b0911e40d7444636e8dc6

Analysis

max time kernel
134s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dteapi.jar
Size

89KB
MD5

6e5c2aabb2b12a21ef5baa3f7e9bb700
SHA1

bf3f0f1ae0d26b3b0ee45af1160fbe3170fc3f77
SHA256

acc1a4db9132fc20171811b4f020ac461874d93be33b0911e40d7444636e8dc6
SHA512

ae8956e4c8b8abe69c83f08a3a22cf94e7182d15b44c26a36227c5475f443aefe24001315f24b88d152d0c584ee088b27dfd7771ece2037b74c46213813dde9d
SSDEEP

1536:fX4gEmQQZf3Nt9xD+5ls+p6BpvyDIyji/LbDk6JgB5BB/A7dG+B2WFQmeK:fXRLZf3Na5c4sL/LS5n/4M+BHy6

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2508	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2508	2652	java.exe	84
PID 2652 wrote to memory of 2508	2652	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\dteapi.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
68be4c45c0ac3ac23f41fb8403a7ff1e

SHA1
3d9584619b0b9274639e67ed3a197cf01439885b

SHA256
902783686cadb7d6a9f42b61164837d1fffaee26d1fe0b17fe15a4a55467d562

SHA512
ccff687d9c48348e03e4fea56bd0bddd71e574d86e335e9cbf1d303c59ac63970330c371596ef5b12cefc7b78f5358e0db1aeec2ef60a6ba73258e5f30139853

Download Submit
memory/2652-2-0x0000020A69EF0000-0x0000020A6A160000-memory.dmp

Filesize
2.4MB

Download
memory/2652-11-0x0000020A68710000-0x0000020A68711000-memory.dmp

Filesize
4KB

Download
memory/2652-13-0x0000020A69EF0000-0x0000020A6A160000-memory.dmp

Filesize
2.4MB

Download