a2a233c3e27112c07e60378fe3a5f7c54b79517526565970412cf71cad7153d8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

audit-system-1.0.0-SNAPSHOT-sources.jar
Size

39KB
MD5

ffcefbe3560c993f9d9f8fa07d44b7c3
SHA1

216fb839379b7a78e70f5748228241cfedfc87c6
SHA256

a2a233c3e27112c07e60378fe3a5f7c54b79517526565970412cf71cad7153d8
SHA512

af5e4be8069a1e5e8bea17bb5a507bef5501f1c8524230aab166c279b97cfea8324b461e4cc3e5275eb0601e9ce8d0a6860ea56669979be9a9f75615c87823a2
SSDEEP

768:ufOn+8ujzg35nUUucQIvEx1MMM0sn0vWXhTZwykC/g0qjaj5ryBYFwi6:MOnRConAcQIvEx1MM+neWXhTqxCqA57o

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3180	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3180	3908	java.exe	85
PID 3908 wrote to memory of 3180	3908	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\audit-system-1.0.0-SNAPSHOT-sources.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
7c68644a747a6494594db663bbcdf1cd

SHA1
5a27dcdf9e721bf92b0b7e7d6dda22eee5f17726

SHA256
fcaf3c6ffb5fc5685e7629987ceff9e1ec0e7c1bdeb529011136d026fb77c029

SHA512
f79164ff80fba4e91298a7c4495b5f054be206b483386019e39ab4b9720be5d7b9428c5a79c080b7d57a1697738c3ac7a58e841df6122210e7e392a8d7961e28

Download Submit
memory/3908-2-0x000001BFA09E0000-0x000001BFA0C50000-memory.dmp

Filesize
2.4MB

Download
memory/3908-12-0x000001BF9F1E0000-0x000001BF9F1E1000-memory.dmp

Filesize
4KB

Download
memory/3908-13-0x000001BFA09E0000-0x000001BFA0C50000-memory.dmp

Filesize
2.4MB

Download