21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06

Resubmissions

23/05/2024, 09:55

240523-lx9t7sce43 1

23/05/2024, 09:54

240523-lw9g2sce4t 7

23/05/2024, 09:27

240523-lerkxabh99 7

Analysis

max time kernel
132s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oraxen-1.166.0.jar
Size

3.3MB
MD5

40749750084a4c61e0cb77d651629815
SHA1

1ad2459615ad3f1d9a81a1ac0b842cf4e6154600
SHA256

21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06
SHA512

91e58141cd3aadeeb66c695881ed63341179f6f5adc8b3e3b1eed5af6c4f124ca11194505fab38cf97ce60b3fc1656d5ec0bb7a1ca2cf9eb163571205e8ac5c7
SSDEEP

49152:b3/pSLJqlqansp2zr7Wwc2+rLiohlqnbwPgq2zvwqBflgtwA6VOgneLlD7nSC9:bhSLeq2spQSG+/DvPwrveTLlXT

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3492	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3492	2296	java.exe	84
PID 2296 wrote to memory of 3492	2296	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\oraxen-1.166.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6e06476d444c64a78ccd52f2f2a7ba2c

SHA1
f70d5b15ef362053fac28811872e0777402b0111

SHA256
c57e9e8a1119c31833c28ef5113c355fa2aea553491059df5f521e58bd439c9e

SHA512
1086e68a69f4d4b40172eacc6aab0cf8f0707c11bedf0cea3111306e2ff3a8708c210d4cd08ca449e57c863e6a7cd923866b10d54f269832fadb9a3b339d57c9

Download Submit
memory/2296-2-0x00000194E3920000-0x00000194E3B90000-memory.dmp

Filesize
2.4MB

Download
memory/2296-12-0x00000194E22E0000-0x00000194E22E1000-memory.dmp

Filesize
4KB

Download
memory/2296-13-0x00000194E3920000-0x00000194E3B90000-memory.dmp

Filesize
2.4MB

Download