1b258ef45fae93059b65d0a0dd109e59ab93e8cd8a735ff66b2ba85f870d5150

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

jakarta.mail-1.6.7.jar
Size

660KB
MD5

17eb378c9dd574be23e71014ce9d5d30
SHA1

319df0e9d536c1a01acdfe49b6e82b97d2393073
SHA256

1b258ef45fae93059b65d0a0dd109e59ab93e8cd8a735ff66b2ba85f870d5150
SHA512

3f392a6ae3eada47c37b67d92f3cf39c609a5309fcc97eb271bcf079d0d01f5973c0d32458a875ac1186092a113bb452439f7b7b0edd58a5b3aba5f775e9a001
SSDEEP

12288:9BPxwu8lnPXqtqaxztxZ7Nu5FTll7lY/vOR95Dj9SsPw:91t8Mtqoz3Z7NMD723oj/1Pw

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1140	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1140	2040	java.exe	83
PID 2040 wrote to memory of 1140	2040	java.exe	83

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jakarta.mail-1.6.7.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
11f789c6c05ba4d386f2be0a56fa8841

SHA1
fe9dafd1eea7900726d4c43999edec70d3731cce

SHA256
5768f9dbdf7ce2726f172f74348ea35e067185cbe3a9fae008a9b9f191d21e60

SHA512
763ea4c9e0b6964371baa79276a48f6309a16c55a4580b50e97cdd08b5da919506c4099898b397ed65efa23b6061529f2c58a2a38891e8fe4c8297b88fd0c2d5

Download Submit
memory/2040-2-0x0000027B80000000-0x0000027B80270000-memory.dmp

Filesize
2.4MB

Download
memory/2040-13-0x0000027B80000000-0x0000027B80270000-memory.dmp

Filesize
2.4MB

Download
memory/2040-12-0x0000027BF1510000-0x0000027BF1511000-memory.dmp

Filesize
4KB

Download