ee2c95d15d1fb522a602beab9292f5045ae98723ba0701628aa45ad9e7faca87

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
worldpainter/WorldPainter Installer.app/Contents/Resources/app/i4jruntime.jar
Size 2.2MB
Sample240603-25wkjsdd25
SHA256 ab1e7d0a8df6da4814f1a94be41f1838a694b12285e87e7354912acb7380f5fc
MD5 8903f4510bc958caa4ecbfdcafdb0eec
SHA1 86df6388bcd85fed1f66e911e3caf4422e0a0c46
SHA512 819987ff06154ca9a3b34758d9644e1bc1264699352055b539ffbbead0a6b0125b14439cc9f76fc526bdee40bbf2b8b6f01569e6ca0b20f191ce7f329ef325f0
SSDEEP 24576:eFJ5ZTcdvkQ3PwfbrDlTUGAN4IwaUNzTO5SLqR/O5lw4xRC+4BtMawEjJwHXgJ8J:I5ZTcdvlfYvRTU4Ia6SLR1CfDjJCXI8J
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
404	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 404	5004	java.exe	85
PID 5004 wrote to memory of 404	5004	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar "C:\Users\Admin\AppData\Local\Temp\worldpainter\WorldPainter Installer.app\Contents\Resources\app\i4jruntime.jar"
1⤵
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 405b672edd052cba874447e579df6e89fa5778e38c0f36f83e00c25ad1823414
MD5 6cd63745933113c0c97abdfc55d9e942
SHA1 5db6dae08b60469d4559ac325001ef42b08eb4bd
SHA512 1bde87ce4b7e9fbbd7b9df0c0b5eab6b79ad942f20fedaa6f3fb4a2985a6d05362f1ce9595fd3cdd35b8b00aa1986f6a0c9ee1c8a42db9b80b52717589f12c7c
MD5 SHA1 SHA512

Submit Download

memory/5004-2-0x00000273B44F0000-0x00000273B4760000-memory.dmp

Download

memory/5004-11-0x00000273B2C00000-0x00000273B2C01000-memory.dmp

Download

memory/5004-13-0x00000273B44F0000-0x00000273B4760000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads