Analysis

  • max time kernel
    108s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 11:17

General

  • Target

    5daa38a2692827ae02e4cf058cb9d0dded63fb774437916045827652bf1c3b5e.exe

  • Size

    428KB

  • MD5

    d36be24be0afd787fbf489da9d2338ea

  • SHA1

    24a25aa9bc2e9bd3a3aed614c87c52fe889a249c

  • SHA256

    5daa38a2692827ae02e4cf058cb9d0dded63fb774437916045827652bf1c3b5e

  • SHA512

    076b36f81c4d2cccf3c127dbd7e38e83379c05e8d2b5ad3c219977f4745644e3e5bfb6a89fa45c33b620f7f4b2250c6d3d26aa64b535b631f4bde619b26e9afa

  • SSDEEP

    12288:ph1UQbSAhgOWAlCwF3DMLo/r9PFCIhlrWDxwP:ph1uAFy84cZPJbyNw

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5daa38a2692827ae02e4cf058cb9d0dded63fb774437916045827652bf1c3b5e.exe
    "C:\Users\Admin\AppData\Local\Temp\5daa38a2692827ae02e4cf058cb9d0dded63fb774437916045827652bf1c3b5e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\5daa38a2692827ae02e4cf058cb9d0dded63fb774437916045827652bf1c3b5e.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2020
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:1976

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    ec9ea093e569ec00b532592f8276b7f6

    SHA1

    9baacd2e801490a0fd274689909d8058deb8dba8

    SHA256

    444d0befc856c536443dc3629e2dac5d386bbcf0993bf531e468f7e166f4279b

    SHA512

    ee6eaa00922461fe17fdf2dc178db2aca8aaa45ace658e8e0da31825cf0fd34648e43b1c1cc579c44e34a848e2fe39982ab1c2a6292ca3689fc8c034f501699c

  • C:\Users\Admin\AppData\Local\Temp\+~JF5812642813926863402.tmp

    Filesize

    117KB

    MD5

    7f690e503a254e0b8349aec0177e07aa

    SHA1

    127f241871a9fe42cd8d073a0835410f3824d57c

    SHA256

    7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7

    SHA512

    329b4fcd0cbb804324a2a0e41542b64949208cffb18d38af50a7ccbaa007c0baf2b241a8077b4db0f6e97385e65ada7d73f6d06a5e55411d549b5a3bf29cd641

  • C:\Users\Admin\AppData\Local\Temp\JNativeHook-7432773EB4D09DC286D43FCC77DDB0E1E3BCE2B4.dll

    Filesize

    83KB

    MD5

    55f4de7f270663b3dc712b8c9eed422a

    SHA1

    7432773eb4d09dc286d43fcc77ddb0e1e3bce2b4

    SHA256

    47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25

    SHA512

    9da5efb0236b3bb4ec72d07bfd70a9e3f373df95d97c825513babd43d2b91c8669e28f3464173e789dad092ea48fc8d32a9d11a6d5c8d9beeabd33860ce6a996

  • memory/2020-61-0x0000025D09A30000-0x0000025D09A40000-memory.dmp

    Filesize

    64KB

  • memory/2020-88-0x0000025D09AC0000-0x0000025D09AD0000-memory.dmp

    Filesize

    64KB

  • memory/2020-63-0x0000025D09A50000-0x0000025D09A60000-memory.dmp

    Filesize

    64KB

  • memory/2020-62-0x0000025D09A40000-0x0000025D09A50000-memory.dmp

    Filesize

    64KB

  • memory/2020-99-0x0000025D09AB0000-0x0000025D09AC0000-memory.dmp

    Filesize

    64KB

  • memory/2020-64-0x0000025D09A60000-0x0000025D09A70000-memory.dmp

    Filesize

    64KB

  • memory/2020-67-0x0000025D09A70000-0x0000025D09A80000-memory.dmp

    Filesize

    64KB

  • memory/2020-68-0x0000025D07FE0000-0x0000025D07FE1000-memory.dmp

    Filesize

    4KB

  • memory/2020-71-0x0000025D09A80000-0x0000025D09A90000-memory.dmp

    Filesize

    64KB

  • memory/2020-73-0x0000025D09A90000-0x0000025D09AA0000-memory.dmp

    Filesize

    64KB

  • memory/2020-78-0x0000025D09AA0000-0x0000025D09AB0000-memory.dmp

    Filesize

    64KB

  • memory/2020-3-0x0000025D097C0000-0x0000025D09A30000-memory.dmp

    Filesize

    2.4MB

  • memory/2020-87-0x0000025D09AB0000-0x0000025D09AC0000-memory.dmp

    Filesize

    64KB

  • memory/2020-57-0x0000025D07FE0000-0x0000025D07FE1000-memory.dmp

    Filesize

    4KB

  • memory/2020-85-0x0000025D07FE0000-0x0000025D07FE1000-memory.dmp

    Filesize

    4KB

  • memory/2020-90-0x0000025D097C0000-0x0000025D09A30000-memory.dmp

    Filesize

    2.4MB

  • memory/2020-91-0x0000025D09A30000-0x0000025D09A40000-memory.dmp

    Filesize

    64KB

  • memory/2020-93-0x0000025D09A50000-0x0000025D09A60000-memory.dmp

    Filesize

    64KB

  • memory/2020-92-0x0000025D09A40000-0x0000025D09A50000-memory.dmp

    Filesize

    64KB

  • memory/2020-94-0x0000025D09A60000-0x0000025D09A70000-memory.dmp

    Filesize

    64KB

  • memory/2020-95-0x0000025D09A70000-0x0000025D09A80000-memory.dmp

    Filesize

    64KB

  • memory/2020-96-0x0000025D09A80000-0x0000025D09A90000-memory.dmp

    Filesize

    64KB

  • memory/2020-97-0x0000025D09A90000-0x0000025D09AA0000-memory.dmp

    Filesize

    64KB

  • memory/2020-98-0x0000025D09AA0000-0x0000025D09AB0000-memory.dmp

    Filesize

    64KB

  • memory/2020-100-0x0000025D09AC0000-0x0000025D09AD0000-memory.dmp

    Filesize

    64KB

  • memory/4500-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB