af456b2dd41c4e82cf54f3e743bc678973d9fe35bd4d3071fa05c7e5333b8482

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

javax.servlet-api.jar
Size

93KB
MD5

79de69e9f5ed8c7fcb8342585732bbf7
SHA1

3cd63d075497751784b2fa84be59432f4905bf7c
SHA256

af456b2dd41c4e82cf54f3e743bc678973d9fe35bd4d3071fa05c7e5333b8482
SHA512

32f7e3565c6cdf3d9a562f8fd597fe5059af0cf6b05b772a144a74bbc95927ac275eb38374538ec1c72adcce4c8e1e2c9f774a7b545db56b8085af0065e4a1e5
SSDEEP

1536:mtzeg5uZYCaY0D2oRqwaO/pgnKqG5JQrHnr0PnEEl0qDx+HD:mtzu70D2oSORgQ5OrAck02xWD

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3500	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3500	1692	java.exe	85
PID 1692 wrote to memory of 3500	1692	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\javax.servlet-api.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
6aaf6af5d7b165c9671d5a25c53525d4

SHA1
96dd29bb4e3420b88400fca181364202da6ba5a0

SHA256
6add4dfe4e61f57aefeb75d59205c61b3d376f7eb1e322bbfd6d27d91f55e6e4

SHA512
a7ace0c273bf0f5a30ea22b620e548eb6eb7e9c9bd89a8477f46cbec3859d5eefee059456f6cc5b7598b09c087678c97288d1be18be0c8668c8ec091df4d363f

Download Submit
memory/1692-2-0x000001C715440000-0x000001C7156B0000-memory.dmp

Filesize
2.4MB

Download
memory/1692-12-0x000001C713BF0000-0x000001C713BF1000-memory.dmp

Filesize
4KB

Download
memory/1692-13-0x000001C715440000-0x000001C7156B0000-memory.dmp

Filesize
2.4MB

Download