2d9d35147d36cc9317e68accf19dad2c82dfe0412d8d54f6c1e020856dc81deb

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099_3933_arpg.jar
Size

8.8MB
MD5

d4669531d3f9dfa4ffa00292510cff8a
SHA1

9cb242b9f0016b575bd9c2534f368151e2caa956
SHA256

2d9d35147d36cc9317e68accf19dad2c82dfe0412d8d54f6c1e020856dc81deb
SHA512

8da07d9875f862647aaec6eba2af09607cad1fbc89c93059997e4df31d04ea98546345d26ed826c068cf75f54cc21f285b164164c435ba0d84e2fccee821f88e
SSDEEP

196608:ZSe2zzQ9LhTExP/YY0fGcnN350Alh2gneGi5Xr5i+hF:UQ9Fi/H0eYN3SfGi5b5nhF

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2084	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 2084	780	java.exe	85
PID 780 wrote to memory of 2084	780	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\099_3933_arpg.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b5785963d797a15d56224eaccbf61d61

SHA1
84ba5f4d75a8b6bfd7fed9e6b5599e06105e0774

SHA256
75b97a76771fa4cc54dbd05fc37cc24eee5c43daaecb5918191070a27ad5cd6f

SHA512
ccc1a232870521cdbf4ff59a7ae99d680ce54a1e909f12e0956acf82515f181b572844b9a3878bcf32e203556dcd6bf779bef44213b9b190db793e72f0bc9334

Download Submit
memory/780-2-0x000001AB2E4A0000-0x000001AB2E710000-memory.dmp

Filesize
2.4MB

Download
memory/780-13-0x000001AB2CC50000-0x000001AB2CC51000-memory.dmp

Filesize
4KB

Download
memory/780-14-0x000001AB2E4A0000-0x000001AB2E710000-memory.dmp

Filesize
2.4MB

Download