b8feebcc2b19f24b6f46724ffd4cb29a55c57e9b1793937bda4656b27192006b

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ForumDown_gpxz/ForumDown/ForumDown.jar
Size

728KB
MD5

fe2600eea9db81be284230c7b8b6d0a9
SHA1

405319a84a7a379a8551185d021d23cda0b7e77e
SHA256

ac02b836f89a32f730c377858ebbfa582125e14d316dc468db29d3b88232906a
SHA512

425d48b1032a571e4a2359b3d2fd71df1e2fc6d1b22b4c7e2e57e0d8e0e1d650f3cb0605a81e949d699d20a85b9a62a2ad236c0662531fb216528034063c2136
SSDEEP

12288:o4jDZc4MjHcJKcw8pWzoaPyfze5JBqO5Wm7JTSd6du8AcLxAjf6bcaBH+0BviXb:owSjRuWzos/qO5Wm75S0u8Acc+Bc0BaL

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1640	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 1640	3364	java.exe	90
PID 3364 wrote to memory of 1640	3364	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ForumDown_gpxz\ForumDown\ForumDown.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-2-0x0000016868CA0000-0x0000016868F10000-memory.dmp

Filesize
2.4MB

Download
memory/3364-11-0x0000016867390000-0x0000016867391000-memory.dmp

Filesize
4KB

Download
memory/3364-13-0x0000016868CA0000-0x0000016868F10000-memory.dmp

Filesize
2.4MB

Download