84f6147cc4763e6c4daf40fb997ec77525b71ca5bff144fcbcca5f9c0e8d3ea5

Analysis

max time kernel
21s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LC_Installer_v2.1.1.exe
Size 296KB
Sample240527-24dcksdd9y
SHA256 84f6147cc4763e6c4daf40fb997ec77525b71ca5bff144fcbcca5f9c0e8d3ea5
MD5 6c1253b52c85395259d73f9ea3647656
SHA1 0e3f1e4f49d3866f3daf195b99485068039ad3f1
SHA512 0c50cac1ccc89497cf6f9278d7aa10afadedad77326e54fb87646b6ccf7b94faadf948983fe8b2e247c540e83960099b1c7adfb3125dc682c3dc78006d420e80
SSDEEP 768:O7Zw33FNUf6Nhd/fQ1l+0vM0iT9D2v+EL0/KKXFWAt:EZ2FWSNhd/4131igv+EL0/zXYA
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1976	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4556	4256	LC_Installer_v2.1.1.exe	92
PID 4256 wrote to memory of 4556	4256	LC_Installer_v2.1.1.exe	92
PID 4556 wrote to memory of 1976	4556	javaw.exe	93
PID 4556 wrote to memory of 1976	4556	javaw.exe	93

C:\Users\Admin\AppData\Local\Temp\LC_Installer_v2.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\LC_Installer_v2.1.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 4034edbe9aff35d0f2871513ff4803d75244b739620a6f5375578d0050ae5ce0
MD5 26f02a6922c0283508b9b20e34b6aa71
SHA1 9e9a18534918e9bf614cb8d6309ddf9c28899a43
SHA512 271cf0c8b4f1ebf07eb7d23ccfcd66063edfae9ec9f52a160118ddac01e2977c35db728acf8b258d988d049ae8a0f8f431cd204694cbe3c7c6d82645c9d57d6f
MD5 SHA1 SHA512

Submit Download

memory/4256-0-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4556-3-0x0000021481D40000-0x0000021481FB0000-memory.dmp

Download

memory/4556-13-0x00000214804F0000-0x00000214804F1000-memory.dmp

Download

memory/4556-15-0x00000214804F0000-0x00000214804F1000-memory.dmp

Download

memory/4556-16-0x0000021481D40000-0x0000021481FB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads