Analysis

  • max time kernel
    137s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:01

General

  • Target

    WBNS X FNF V1/plugins/access/libbluray-awt-j2se-1.3.2.jar

  • Size

    68KB

  • MD5

    5b8dc68b7a41a3f64f7c630b6ad50578

  • SHA1

    e64eaeb45b1e15071f660dda489225e11a72100c

  • SHA256

    6ee22bfa0801fe733d769d1a9fb7264185986f8f4f0459408264b043851684bc

  • SHA512

    7db252a8e5187d0709e34e7e7bc534e2f6946bb73d5550a4bd2f0ed768ca2b5d8e8606a4f6a373220e65cda48f82aca84f77e227b0c832a064829add527c489c

  • SSDEEP

    1536:vsYBIlvwdVTCcXaqWoHIOACjEcAbkUbCvj4x+UdQ/w4BgPgau:UYTdkoJA1zbk2WMx/z4BgK

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\WBNS X FNF V1\plugins\access\libbluray-awt-j2se-1.3.2.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    3211f5df89765a7779e0c9382778e890

    SHA1

    f4b98ef1b9191265700f94e0a7da5bacfd576c01

    SHA256

    0a6e0087edf5025c118c3cf72eba603cf385ff971c21b22b7c580446fede1d71

    SHA512

    8c2b964f14d5b6faf317559718b443676c70fb3600731952ec5a7bfa786de34df6c218a0bdd6609b7a00657a1ce99fad4c66fc21ede8b6973142d6ba3eec8fff

  • memory/1144-2-0x000001A0149A0000-0x000001A014C10000-memory.dmp

    Filesize

    2.4MB

  • memory/1144-12-0x000001A013180000-0x000001A013181000-memory.dmp

    Filesize

    4KB

  • memory/1144-13-0x000001A0149A0000-0x000001A014C10000-memory.dmp

    Filesize

    2.4MB