cc6271c9543b584d8aaa12285fbe58ad17807d2b8557c73129ba3589db7def54

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4BC279C404401D55DF1811A08A43ACF8BC06FB92-validator-20200626-patched2.jar
Size

4.1MB
MD5

e101fca54450aa725265bc12a3908ebd
SHA1

4bc279c404401d55df1811a08a43acf8bc06fb92
SHA256

cc6271c9543b584d8aaa12285fbe58ad17807d2b8557c73129ba3589db7def54
SHA512

e7a56698cea11a66c801f114f20d0a390e9ba58169cc069f52c54e195f360e861172593667b5489717631040a6302522112539fcc38fc81b7732e3b9977a424c
SSDEEP

98304:aRf764NdUYHskaKMLjYTQc4yJObqmn5AcmkksN:aRf76qxpJM3YTQc4yJO+4hZN

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
60	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 60	3516	java.exe	86
PID 3516 wrote to memory of 60	3516	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\4BC279C404401D55DF1811A08A43ACF8BC06FB92-validator-20200626-patched2.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b158f595dbcdca0210eeec6a77a471f1

SHA1
dd5b15e5184a4164da3070474a2888e001ec2726

SHA256
10af3ce058ba00666d97b2c95151b24ec8d03d265fe922f1d908b3218e31ebea

SHA512
d56b150b869636814af4c85ead12c8df13e5d267ca674ffc04071d4c63127ff4d19ecf59b19870b5021f799c2f9d455c2170a95bd079a32cace4a6561e5b7144

Download Submit
memory/3516-2-0x0000021126600000-0x0000021126870000-memory.dmp

Filesize
2.4MB

Download
memory/3516-13-0x0000021126600000-0x0000021126870000-memory.dmp

Filesize
2.4MB

Download
memory/3516-12-0x00000211265E0000-0x00000211265E1000-memory.dmp

Filesize
4KB

Download