Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-06-2024 13:54

General

  • Target

    decompiler for malware/Grabbers-Deobfuscator-main/utils/bin/fernflower.jar

  • Size

    690KB

  • MD5

    be01dbc47a455dddfc724d5efe13b490

  • SHA1

    0d96a3b0cb32a0e70cc563a2dcdcea5ef61d45b5

  • SHA256

    74b609647d74e4ce04e9beef230a7460e74de03bf41703f961bbe704d4938b8f

  • SHA512

    4ee6e1b935bc428e16103485da5440ae5b968334f023c7872247d52f1d0c000f8f49bc9101e955999c0338c88d34392f14eff2143c167675f7f5888a0be91094

  • SSDEEP

    12288:lSBknFucLVNrGJASNYa5k3qIhOhsioN46D2xFGDwHyhfsYFY5D/:lUcLVNEA0N5kaVhBjGDdhkYUD

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\decompiler for malware\Grabbers-Deobfuscator-main\utils\bin\fernflower.jar"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
    Filesize

    46B

    MD5

    4c2868877d2675e51c28fe69d1a31979

    SHA1

    226a253b4dbccd6c77d55534f3e6adc46ac28f50

    SHA256

    3ff7e6690277c43130bb2e9b8a89784c6ca86aab4d6840d97ec5dd61991081fd

    SHA512

    1925e9d918056319dd8461e76e5202ff84637da8a438722ed7ed48153ec5c412d77d995661f418752b6666e4712758e950dfbd7bc9ec17a35aef855acbf19dba

  • memory/2856-2-0x000001E3EC4D0000-0x000001E3EC740000-memory.dmp
    Filesize

    2.4MB

  • memory/2856-12-0x000001E3EAD00000-0x000001E3EAD01000-memory.dmp
    Filesize

    4KB

  • memory/2856-14-0x000001E3EC4D0000-0x000001E3EC740000-memory.dmp
    Filesize

    2.4MB