21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06

Resubmissions

23/05/2024, 09:55

240523-lx9t7sce43 1

23/05/2024, 09:54

240523-lw9g2sce4t 7

23/05/2024, 09:27

240523-lerkxabh99 7

Analysis

max time kernel
137s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oraxen-1.166.0.jar
Size

3.3MB
MD5

40749750084a4c61e0cb77d651629815
SHA1

1ad2459615ad3f1d9a81a1ac0b842cf4e6154600
SHA256

21ed5d1df342b9e180c0e9ac5ab8d72aeb9e1ce70a0f90bd87198b136f169b06
SHA512

91e58141cd3aadeeb66c695881ed63341179f6f5adc8b3e3b1eed5af6c4f124ca11194505fab38cf97ce60b3fc1656d5ec0bb7a1ca2cf9eb163571205e8ac5c7
SSDEEP

49152:b3/pSLJqlqansp2zr7Wwc2+rLiohlqnbwPgq2zvwqBflgtwA6VOgneLlD7nSC9:bhSLeq2spQSG+/DvPwrveTLlXT

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2444	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 2444	4012	java.exe	84
PID 4012 wrote to memory of 2444	4012	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\oraxen-1.166.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
66dfde3d20e230d4e4ad9293dd4fa3f8

SHA1
42ca605f35921a662c7324a1c177e7253e806b5a

SHA256
b96c9009c8f17ee13891a22c7f768a146b2f4927ccc6fc8fa24af451ce58719c

SHA512
5887de3f9a128a3cba94a9564409344984d337b187f90d27e002aee1ebaba465ab84ee31ca0376dd771ce136309e258e5dc0d3308567a1fa8549cd0591b1430b

Download Submit
memory/4012-2-0x0000020D8C520000-0x0000020D8C790000-memory.dmp

Filesize
2.4MB

Download
memory/4012-12-0x0000020D8C500000-0x0000020D8C501000-memory.dmp

Filesize
4KB

Download
memory/4012-13-0x0000020D8C520000-0x0000020D8C790000-memory.dmp

Filesize
2.4MB

Download