15595a972ed17185a3bebcd116ee8ffccc2ac10137f774d9d9f20e43dc63e489

Analysis

max time kernel
133s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

spring-jdbc.jar
Size

417KB
MD5

77bd83577d0e164b84d6fda6967a7798
SHA1

5c840abbdc1a1dfd0f79c4a4c25eac0c98e6af22
SHA256

15595a972ed17185a3bebcd116ee8ffccc2ac10137f774d9d9f20e43dc63e489
SHA512

261200dd34379f34f1d79f390eba3c78a292d51232d16ce0faa5ac869429f06f45442b47e52befbb5f9263bc304e3a42f40cb5443edebbea90d86a02eedff9f7
SSDEEP

12288:iJAMxixsBClYZOBUmTtqgVjUVL55LNanqXhpz:8AXW40GggeLZanqxF

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2064	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 2064	4180	java.exe	84
PID 4180 wrote to memory of 2064	4180	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\spring-jdbc.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4666576d531488509dfe61cf42f1f049

SHA1
0139222fc2bb1901dc19c3f784507014b147fb7c

SHA256
bf3b465fcbc039cf50fe91d495b044522585809dd6527d1cae4afae10d0073d9

SHA512
55fb9740c56aaad2e3a5c8c771a4284c7de359f5db0d9eac5fdb1ceeac395d4a169aa3542c25636298955e62c65d39059563ac42511fd57d4c24e0f166bd0abb

Download Submit
memory/4180-2-0x0000027F84A70000-0x0000027F84CE0000-memory.dmp

Filesize
2.4MB

Download
memory/4180-12-0x0000027F83090000-0x0000027F83091000-memory.dmp

Filesize
4KB

Download
memory/4180-13-0x0000027F84A70000-0x0000027F84CE0000-memory.dmp

Filesize
2.4MB

Download