62e2c15b9c217e3807365395ba54176e7fd2bff37f1f843727059760ecb73f9a

Analysis

max time kernel
130s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dm7JdbcDriver16-7.6.0.77.jar
Size

1.3MB
MD5

c0d5babd43a8c74477f31780085a8ad0
SHA1

a9d39b053b674a3c288ff2d0846533393a98e9d4
SHA256

62e2c15b9c217e3807365395ba54176e7fd2bff37f1f843727059760ecb73f9a
SHA512

bb2b783702637af82dfeffa90cbd8e98ca4cd3878cd4f9128f8b15f44e7d994d866caac56ace98fe71c7f8cd2f815a8ff15117f2918c82443625ecbc4e13acb2
SSDEEP

24576:3VNnF5VoQ7FPkYhvCZwLeWBZWqwum8vHRh8myKFMWTZEiUSWB871a8DMaJSta5cC:3VNWSPdhgAeWsudZhNBcSWCrixCh

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2076	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2076	4592	java.exe	84
PID 4592 wrote to memory of 2076	4592	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Dm7JdbcDriver16-7.6.0.77.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
de9c3162c503f92189ff7536dcc5cf84

SHA1
aa6dc08544bf01bdb0c9e78dc00333c0bd68aea2

SHA256
20f800900640a1c0fa5b34ce884bb22c76949419b2638cb18fb00deb7453c8b0

SHA512
4d3618863a03ca1cf39814a944d416f1577fc2373c81aa936af78a7b1b3fe233b1d3d046e820366282950ef11167831581cc2cae8511675d68475ae2dc0e7b99

Download Submit
memory/4592-2-0x000002533C1A0000-0x000002533C410000-memory.dmp

Filesize
2.4MB

Download
memory/4592-13-0x000002533C180000-0x000002533C181000-memory.dmp

Filesize
4KB

Download
memory/4592-14-0x000002533C1A0000-0x000002533C410000-memory.dmp

Filesize
2.4MB

Download