17c29f8d37f4708988e0be931bdbb24a0ad66cfde4a86bafd58f3ff84df370d5

Analysis

max time kernel
133s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
index.jar
Size 11KB
Sample240526-pb241sbb2x
SHA256 17c29f8d37f4708988e0be931bdbb24a0ad66cfde4a86bafd58f3ff84df370d5
MD5 5207d5b85b37cdb2c64086222266205f
SHA1 6cea3fdffcae5a238c38c795136dc83291f50225
SHA512 8ee186199d183fbb81e74849696a98ef1e978bd5cc3f3c7ac87d0d86592f0637f7004dda4a9d4ceb512a304d3a5d9cead42af45b39bb1e3a98e802c001f3da4a
SSDEEP 192://hhEpvIhasaHCysaylo0j9xv28XLilRtGJ0HLIUE7p8HUsz0MgAc+4Uol://hhEehadHCto0Jxv2oilTGJKL27iHUl
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3448	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 3448	920	java.exe	84
PID 920 wrote to memory of 3448	920	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\index.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 4216c865af2ba2d2bbc5ace0aab4cbfaed202d1776457ab47250817b67e75c4f
MD5 2367a7e8a3ba719f1d9eff8cb3d8e435
SHA1 6f01b475bc806de1d40c5a3dec2c55b9ef63a314
SHA512 7e642fcd5b086f6c2976e43b68d3a3e73faeeb5d82937b4e8cd821c2cf4c16db957fe47a4c57a27825065bc46d18426db8bb519eb0a66dadbe1a9e79013f4e7c
MD5 SHA1 SHA512

Submit Download

memory/920-2-0x0000019C00000000-0x0000019C00270000-memory.dmp

Download

memory/920-12-0x0000019C73300000-0x0000019C73301000-memory.dmp

Download

memory/920-13-0x0000019C00000000-0x0000019C00270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads