d97404002e0dc33afd30404a4462706b9892d82161c47d5b6ac57b4f0c397526

Resubmissions

30/05/2024, 14:20

240530-rnjjjsbd6v3

30/05/2024, 14:17

240530-rl1eaace277

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
30/05/2024, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vape v4.10/vape-loader.jar
Size 5.7MB
Sample240530-rl1eaace27
SHA256 5fdcb68e0b267332bf806b1e465c0e55eb2b8140c932c2b8856de804c83f1a55
MD5 942b440da0b181b775771d1543084f30
SHA1 666ac2ae1d22c0ad657d89e2074044d27b9caa18
SHA512 41d05c4c12696a0c70c3640ba282154d5987cf66742999c5ecfdcfb66e62c4276c4a8afdc7f98211a195441184057b0ca9ed4a7526950987671db9f8b99214e6
SSDEEP 98304:CDbPd7m1KUTz0KPXX2jPlSS1i3oG7bMDtILXHdGE9EWaDMg0gzAmUnlJ5ruI+69P:2LpJUTN/oPES1i3oG0qJVGWmMgxzAn5L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3024	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3024	644	java.exe	78
PID 644 wrote to memory of 3024	644	java.exe	78

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\vape v4.10\vape-loader.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7fbacacb5c958b60978dc7db100902cd64c52b400d2f9b87db7e96d2f1414a4e
MD5 6ab0b5a452fadb3a0784c55007e45ce5
SHA1 a4f94248015aabac7cc9da363eb3233082375a83
SHA512 44efe0df11cf490c0930267dbc5f094bbb4a9418eb47d0b0606348f27db9849ff5cd65d6ad4c847d25ff80463ae1c2ebe4b381f1142c41a8d3bbc85971f05562
MD5 SHA1 SHA512

Submit Download

memory/644-2-0x000001CC63880000-0x000001CC63AF0000-memory.dmp

Download

memory/644-13-0x000001CC62040000-0x000001CC62041000-memory.dmp

Download

memory/644-14-0x000001CC63880000-0x000001CC63AF0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads