24147c947531116d111143c24e4f37b35a8a9b1fda2e5bba67a30f7a8caa5f79

Analysis

max time kernel
130s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DCSCutdown_4_0_0.jar
Size

9.0MB
MD5

61b3b6e16b4302920cea9ce93c2beed1
SHA1

ec483d6d7a1c9b3af6a59c2a08bbf68f832927f8
SHA256

24147c947531116d111143c24e4f37b35a8a9b1fda2e5bba67a30f7a8caa5f79
SHA512

d0e396b0543d9fde94afb532b96f74727d262ac5e396b2069bf2191ba3344cc475f21301a22a1e82adbcc124879f92070b8f755a6623d8f8d99015887b4b79c3
SSDEEP

196608:J75novPHk/MeRA56ZhO7N5RbNkXb4s9mIb30232pYaY6k+ohE6k1yZE:JCE/MeRA5S0NtkZkEaY6L6kf

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2264	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2264	2532	java.exe	84
PID 2532 wrote to memory of 2264	2532	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\DCSCutdown_4_0_0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f32ffaae6ccda8cf36327a7f824fca57

SHA1
7c60b8fcd642c9c3dc554b9c93c5f62a38e28523

SHA256
5c1dac80b2f46a806d20648424ac21d1b136be14f83270f48e28abb817dbbaf9

SHA512
61c50519bac72df7ba777ede75093f628c71d19e3dedb0dc2ea6289355fa54e9f159eb9e74efc68df327fd213ea7429140dfcf4f5121b8160ec23c6a213f771a

Download Submit
memory/2532-2-0x000001DA80000000-0x000001DA80270000-memory.dmp

Filesize
2.4MB

Download
memory/2532-12-0x000001DAFDF10000-0x000001DAFDF11000-memory.dmp

Filesize
4KB

Download
memory/2532-13-0x000001DA80000000-0x000001DA80270000-memory.dmp

Filesize
2.4MB

Download