a6b4a1474c325d082705d93ee0a7949aa377253804e669f8a68e3d3656245a16

General

Target

69782b8fe3ae301a125f28f07ec3107e_JaffaCakes118.jar
Size

389KB
MD5

69782b8fe3ae301a125f28f07ec3107e
SHA1

148a4348b0704ad79183095a301aaec93ecaa71e
SHA256

a6b4a1474c325d082705d93ee0a7949aa377253804e669f8a68e3d3656245a16
SHA512

2648763f5c8d6f466ac9a637c23eae83d8a7e1ea1ac8a128a2ac9c3548d89b3d18b7bc660471deea4b21152768893a1cd5480c90c20223a7954c3dde7bf52c7f
SSDEEP

12288:qeLa37feUhG2iKzH9PmJFZYMwlv1eyQaCWE:5qfyHKzHMWBkyQaq

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1240 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 3620 wrote to memory of 1240 3620 java.exe icacls.exe
PID 3620 wrote to memory of 1240 3620 java.exe icacls.exe

pid	process
1240	icacls.exe

description	pid	process	target process
PID 3620 wrote to memory of 1240	3620	java.exe	icacls.exe
PID 3620 wrote to memory of 1240	3620	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\69782b8fe3ae301a125f28f07ec3107e_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
76826812899ab9ab481553887a860f30

SHA1
e1d6f6d9e94323f7c76e7a567534e5e062122b00

SHA256
f5bd821e2e397a60174774282e7700226cb42d3bebcd9fc9614d6330fc9e2d68

SHA512
e4b13c6a92c808ef4184e633b6d759b1bae3d9f3cd76b3dfa81d84b878222b98f622cf3a3ab635e7ae8e1190642abbe71983e0edf7932c61f7c1ffb5182d85b1

Download Submit
memory/3620-2-0x0000025B11790000-0x0000025B11A00000-memory.dmp

Filesize
2.4MB

Download
memory/3620-12-0x0000025B0FF10000-0x0000025B0FF11000-memory.dmp

Filesize
4KB

Download
memory/3620-15-0x0000025B11A00000-0x0000025B11A10000-memory.dmp

Filesize
64KB

Download
memory/3620-16-0x0000025B11A10000-0x0000025B11A20000-memory.dmp

Filesize
64KB

Download
memory/3620-20-0x0000025B11A20000-0x0000025B11A30000-memory.dmp

Filesize
64KB

Download
memory/3620-21-0x0000025B11A30000-0x0000025B11A40000-memory.dmp

Filesize
64KB

Download
memory/3620-23-0x0000025B11A40000-0x0000025B11A50000-memory.dmp

Filesize
64KB

Download
memory/3620-24-0x0000025B11A50000-0x0000025B11A60000-memory.dmp

Filesize
64KB

Download
memory/3620-27-0x0000025B11A60000-0x0000025B11A70000-memory.dmp

Filesize
64KB

Download
memory/3620-28-0x0000025B11A70000-0x0000025B11A80000-memory.dmp

Filesize
64KB

Download
memory/3620-32-0x0000025B11A90000-0x0000025B11AA0000-memory.dmp

Filesize
64KB

Download
memory/3620-37-0x0000025B11AB0000-0x0000025B11AC0000-memory.dmp

Filesize
64KB

Download
memory/3620-41-0x0000025B11AC0000-0x0000025B11AD0000-memory.dmp

Filesize
64KB

Download
memory/3620-36-0x0000025B11AA0000-0x0000025B11AB0000-memory.dmp

Filesize
64KB

Download
memory/3620-45-0x0000025B11AF0000-0x0000025B11B00000-memory.dmp

Filesize
64KB

Download
memory/3620-44-0x0000025B11AE0000-0x0000025B11AF0000-memory.dmp

Filesize
64KB

Download
memory/3620-43-0x0000025B11A00000-0x0000025B11A10000-memory.dmp

Filesize
64KB

Download
memory/3620-35-0x0000025B11790000-0x0000025B11A00000-memory.dmp

Filesize
2.4MB

Download
memory/3620-31-0x0000025B11A80000-0x0000025B11A90000-memory.dmp

Filesize
64KB

Download
memory/3620-46-0x0000025B11A10000-0x0000025B11A20000-memory.dmp

Filesize
64KB

Download
memory/3620-47-0x0000025B11AD0000-0x0000025B11AE0000-memory.dmp

Filesize
64KB

Download
memory/3620-50-0x0000025B11A30000-0x0000025B11A40000-memory.dmp

Filesize
64KB

Download
memory/3620-49-0x0000025B11A20000-0x0000025B11A30000-memory.dmp

Filesize
64KB

Download
memory/3620-51-0x0000025B11B00000-0x0000025B11B10000-memory.dmp

Filesize
64KB

Download
memory/3620-53-0x0000025B0FF10000-0x0000025B0FF11000-memory.dmp

Filesize
4KB

Download
memory/3620-54-0x0000025B11A40000-0x0000025B11A50000-memory.dmp

Filesize
64KB

Download
memory/3620-55-0x0000025B11B10000-0x0000025B11B20000-memory.dmp

Filesize
64KB

Download
memory/3620-57-0x0000025B11A50000-0x0000025B11A60000-memory.dmp

Filesize
64KB

Download
memory/3620-58-0x0000025B11B20000-0x0000025B11B30000-memory.dmp

Filesize
64KB

Download
memory/3620-61-0x0000025B11B30000-0x0000025B11B40000-memory.dmp

Filesize
64KB

Download
memory/3620-60-0x0000025B11A60000-0x0000025B11A70000-memory.dmp

Filesize
64KB

Download
memory/3620-64-0x0000025B11A70000-0x0000025B11A80000-memory.dmp

Filesize
64KB

Download
memory/3620-67-0x0000025B11A80000-0x0000025B11A90000-memory.dmp

Filesize
64KB

Download
memory/3620-69-0x0000025B11B40000-0x0000025B11B50000-memory.dmp

Filesize
64KB

Download
memory/3620-68-0x0000025B11A90000-0x0000025B11AA0000-memory.dmp

Filesize
64KB

Download
memory/3620-72-0x0000025B0FF10000-0x0000025B0FF11000-memory.dmp

Filesize
4KB

Download
memory/3620-73-0x0000025B11A70000-0x0000025B11A80000-memory.dmp

Filesize
64KB

Download
memory/3620-78-0x0000025B11A50000-0x0000025B11A60000-memory.dmp

Filesize
64KB

Download
memory/3620-79-0x0000025B11A60000-0x0000025B11A70000-memory.dmp

Filesize
64KB

Download
memory/3620-91-0x0000025B11B40000-0x0000025B11B50000-memory.dmp

Filesize
64KB

Download
memory/3620-90-0x0000025B11B30000-0x0000025B11B40000-memory.dmp

Filesize
64KB

Download
memory/3620-89-0x0000025B11B20000-0x0000025B11B30000-memory.dmp

Filesize
64KB

Download
memory/3620-88-0x0000025B11B10000-0x0000025B11B20000-memory.dmp

Filesize
64KB

Download
memory/3620-87-0x0000025B11B00000-0x0000025B11B10000-memory.dmp

Filesize
64KB

Download
memory/3620-86-0x0000025B11AF0000-0x0000025B11B00000-memory.dmp

Filesize
64KB

Download
memory/3620-85-0x0000025B11AE0000-0x0000025B11AF0000-memory.dmp

Filesize
64KB

Download
memory/3620-84-0x0000025B11AC0000-0x0000025B11AD0000-memory.dmp

Filesize
64KB

Download
memory/3620-83-0x0000025B11AB0000-0x0000025B11AC0000-memory.dmp

Filesize
64KB

Download
memory/3620-82-0x0000025B11AA0000-0x0000025B11AB0000-memory.dmp

Filesize
64KB

Download
memory/3620-81-0x0000025B11A80000-0x0000025B11A90000-memory.dmp

Filesize
64KB

Download
memory/3620-80-0x0000025B11790000-0x0000025B11A00000-memory.dmp

Filesize
2.4MB

Download
memory/3620-77-0x0000025B11A30000-0x0000025B11A40000-memory.dmp

Filesize
64KB

Download
memory/3620-76-0x0000025B11A20000-0x0000025B11A30000-memory.dmp

Filesize
64KB

Download
memory/3620-75-0x0000025B11A10000-0x0000025B11A20000-memory.dmp

Filesize
64KB

Download
memory/3620-74-0x0000025B11A00000-0x0000025B11A10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing