d453f0e745c8ea0ff5d918d0358662dec10af3b8cef3061e445ec87aca4cd8fe

Analysis

max time kernel
133s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sourceCode\cleartrack\jaxp-api.jar
Size 26KB
Sample240528-aee2bsfb31
SHA256 f9e7ecfd4a0cb37539af19b10d3a7128c8173474c25fcdb1623ffacf4842fa91
MD5 b50cb3270d4b89586d69d795f20e602f
SHA1 732ef40aaafded74aaff26c4285e115c50fb87a5
SHA512 57f6b895a4a2cc52f67c8d97dfe73217352291d2db3dad7f13fb414f9d2da16abb2ee01c01983592904bc1efb0639b286ba453f015e685162c0d543edebcbe99
SSDEEP 384:QcjO2iqmiwOYMYY4ULYXZm+RBc4CsGz4o8pg+Lrw2KuxGAX2pZa29AgOF:9cq5wOYGrYXFBByTOGu0+F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4100	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4100	4304	java.exe	86
PID 4304 wrote to memory of 4100	4304	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\sourceCode\cleartrack\jaxp-api.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 56b96e54d3cbbd1ad61a7af1eda492ce125e61597c823e02bedd75198af11d7f
MD5 3e21223ca616a4e6a463ac077ad627a1
SHA1 b0e33ed56b7dbfaec4eeb0628d0646af007c506d
SHA512 a486592af2159d7ca0f366b5841030c99af58d587c995c30334a14bca141da0db51f2435ba7f4d2c1f4932885acbd97ed284b674f6568424830ea85b65d066ac
MD5 SHA1 SHA512

Submit Download

memory/4304-2-0x0000011DA8D20000-0x0000011DA8F90000-memory.dmp

Download

memory/4304-12-0x0000011DA7480000-0x0000011DA7481000-memory.dmp

Download

memory/4304-13-0x0000011DA8D20000-0x0000011DA8F90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads