d453f0e745c8ea0ff5d918d0358662dec10af3b8cef3061e445ec87aca4cd8fe

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sourceCode\cleartrack\jlfgr-1_0.jar
Size 111KB
Sample240528-aee2bsfb31
SHA256 faf4dcd25b962492e5c5a6a534ce3a203a69382cd150e9ac5a81ce481a47a536
MD5 88b00348a6f398a034c4c3999c097f47
SHA1 ca531553caad2d15ae5b5d4ec1a119ce8a14d70a
SHA512 abd04ed40e57d182a8da82f2fcb2b4551e7130aac148017621a6d53eb1871042debb77bea2cbb2df668b9c15fc23c473bf96b706950cbcdee922865a7a25d449
SSDEEP 1536:aZqzCLnlsGl4ZTKSPSVTcUP8dyQswoxswNg1F:asAnGyXQY0dyQ1utNg1F
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2300	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2300	2172	java.exe	86
PID 2172 wrote to memory of 2300	2172	java.exe	86

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\sourceCode\cleartrack\jlfgr-1_0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 00b0c31c28de1830ea698f769ccb9d00a3a22ecf738a2de3692c8438a7014b74
MD5 f36f5c5d29e6b9f6fb8bd23e5882212d
SHA1 ccc98cc25bb28fb7a6ca4532d7c052e771dec507
SHA512 3405cc491a1237f21c5d0619d4bcf00f8d1e29827eb13cace7aa052512b0090c4428fd37128cfb63aceb9505c0d5751bf18d7c8f8c908737653f83794d805a8a
MD5 SHA1 SHA512

Submit Download

memory/2172-2-0x000001F9A2F90000-0x000001F9A3200000-memory.dmp

Download

memory/2172-12-0x000001F9A2F70000-0x000001F9A2F71000-memory.dmp

Download

memory/2172-13-0x000001F9A2F90000-0x000001F9A3200000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads