ac422be6bcdef0c521c5de80f37a579f0176a7731abd14fa76540fb56d485961

Analysis

max time kernel
132s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VMod.jar
Size

97KB
MD5

32e88ca1a31945dfa5116a1c0189a2c9
SHA1

fe18ccf5ed5589804853363b3dfd488549c842da
SHA256

ac422be6bcdef0c521c5de80f37a579f0176a7731abd14fa76540fb56d485961
SHA512

1ac0c17a1880a00465c954d026a71ec42648fbedcd6098e48bdc5003a7c540eee2b8f61d7859241c10c31bb789d72334732fcfbb52c4db5308b2a0686f7f6f91
SSDEEP

3072:V27A3U1CUxUM7fHwn+Kv10780inoa5Up+jBNAC:VmAkEvaInl6ILnzUiBNP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3024 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3008 wrote to memory of 3024 3008 java.exe icacls.exe
PID 3008 wrote to memory of 3024 3008 java.exe icacls.exe

pid	process
3024	icacls.exe

description	pid	process	target process
PID 3008 wrote to memory of 3024	3008	java.exe	icacls.exe
PID 3008 wrote to memory of 3024	3008	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\VMod.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4328,i,5047420736443372512,9747851268033796534,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
1⤵
PID:3548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
e1984fa31a85d84f7ab0fc5c0f040f72

SHA1
a7cef5b84d765aa1a9b0494f4254d499f0f6b9f7

SHA256
e2b74250a60c96ef5fd71233b18a76ef935b9278c6f1d3fde8f67c6e8f55c141

SHA512
6ca0ff945ccef320d9f3d4e8686d29a9d03437d06f6f2d98546a503f5219ee21a7393f27cec2d519a75d5829f20e8eb390732174a0a36eae39c4113593355e8b

Download Submit
memory/3008-2-0x00000239E1B90000-0x00000239E1E00000-memory.dmp

Filesize
2.4MB

Download
memory/3008-12-0x00000239E01A0000-0x00000239E01A1000-memory.dmp

Filesize
4KB

Download
memory/3008-13-0x00000239E1B90000-0x00000239E1E00000-memory.dmp

Filesize
2.4MB

Download