Analysis

  • max time kernel
    134s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 12:31

General

  • Target

    macjihuo-2022/micool_macconfig/configfile/micool/plugins/hideme.jar

  • Size

    7KB

  • MD5

    cdab6a30b0949a741f13935f5483c303

  • SHA1

    729d00e4fa04ca49c00b5b6aa60706dfadd5644e

  • SHA256

    fa14c735ab9fed3f3a5df0dc78a5d38ae0a146099ddc858197e9f528bd996c40

  • SHA512

    bf155c0b062fe9c7c237f9b0329a155387b7294fae7c7ed73e41e9528f119ccc513855329f6e91e62106b589c8b215d981ed11f2f89c7e13c06fbdcf7d6d1ee8

  • SSDEEP

    96:ohFTqRYuFhXQ5GeiCGkeFUgbH44yY8NVFubQLwNUmvHh18OiPKwChme:gFuRDiiCSbH4u8ZuvOMBGOiEme

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\macjihuo-2022\micool_macconfig\configfile\micool\plugins\hideme.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2308
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:8
    1⤵
      PID:2456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      6949ebf6daafd767395fbe0db55cf4fa

      SHA1

      d8f2f1542d31463974151c23e2e00ca9637051fb

      SHA256

      ae4d3c3546535bdd215ee2bc17918f5e14567d1b7047ce06ae683f571a3d1080

      SHA512

      e9eb75cf6cc813d75607858ce2d7da79eb5524de9270f1e8c639ba0864dc95fd3503829aaf147d7ce111859dbbbc09cb102ba6dcdaff4df18c081ce9a0622ccf

    • memory/1704-2-0x000001D480000000-0x000001D480270000-memory.dmp

      Filesize

      2.4MB

    • memory/1704-11-0x000001D4EFD90000-0x000001D4EFD91000-memory.dmp

      Filesize

      4KB

    • memory/1704-13-0x000001D480000000-0x000001D480270000-memory.dmp

      Filesize

      2.4MB