19793a36fb851b40a9840665eba0bab85a87092123ee360914abaa6fb09ae0c8

Analysis

max time kernel
92s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 04:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OpalClient.jar
Size

6.7MB
MD5

10377759c45415445d7d9d530f887fc5
SHA1

3d5aed2b9e6a0d2c11514cc391c009757cf9548e
SHA256

19793a36fb851b40a9840665eba0bab85a87092123ee360914abaa6fb09ae0c8
SHA512

319383b5db087217782a11ae813d9e421749b60a760de9ad715a4c487e806785ec14f4330901404250af474bf5c4bb36551e435480e846f82d51ed8b8cc46da7
SSDEEP

196608:AUt9ql3Oq6ulLBOOTxmFoYtM8nbfKtQXtZQCgy8C1fn:A+43T6ulLBOXOYtM8mtSHv8q

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4896	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4896	4916	java.exe	83
PID 4916 wrote to memory of 4896	4916	java.exe	83

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\OpalClient.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f792566344e2b55d18c00a1b2ae180f0

SHA1
adf43579036f2e4e8590e4e1e325a48d4bcff718

SHA256
a11f124d727e5de3013fee9f4e2644ecdc423060e6e3ab350e9f6bc420372127

SHA512
319d7f7326c546b0119adea60843e75261763ad362b21fbfe35056a22cd8a24393d6f365660ea196019045a65edc11e32cb93ac2f064e876eb6645f08a33af41

Download Submit
memory/4916-2-0x000002586AC30000-0x000002586AEA0000-memory.dmp

Filesize
2.4MB

Download
memory/4916-12-0x00000258695F0000-0x00000258695F1000-memory.dmp

Filesize
4KB

Download
memory/4916-13-0x000002586AC30000-0x000002586AEA0000-memory.dmp

Filesize
2.4MB

Download