Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 12:31

General

  • Target

    macjihuo-2022/micool_macconfig/configfile/micool/plugins/mymap-v1.0.1.jar

  • Size

    4KB

  • MD5

    7a0e7526ba7542c94fdc8f5bd0a4052c

  • SHA1

    37c069fdde8182879bf4958d703a19113bbae4ec

  • SHA256

    2a20c5f9a05820f522d9338c57aeac51232422af87ac299c3bb541e948549774

  • SHA512

    96bbb690f150322a8a86e88f013f749f55f67f41b4f5f19b78121d8d653b851c290c17e6e551b89e5ed37c38b1c408511cb67c5f15c627edf11a9ce61a480e89

  • SSDEEP

    96:Bn+DGJBqyu5t762MDaLFlFqz5e32NULTeDAjC4wK1Iuu:B+Mq35t7g+mAqULTLHwsIx

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\macjihuo-2022\micool_macconfig\configfile\micool\plugins\mymap-v1.0.1.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    9ab40c8421744e6858b60b0eaf7233d0

    SHA1

    a0d114107dee7594d659d4c241258ca4a96a4534

    SHA256

    d052e6b1fb93c3f6b70adf88316b4ec46190822b820749366b8be6af3fc62b60

    SHA512

    7fa50020cf99c73723707f08bbd0ae9ff0eab3bec39b983b14b6185471fa46d36a1b3fdd34bfd3efd7a10b6dcce7c239ed0599bcfbb09664acd8c00d74d23f63

  • memory/4844-2-0x0000020964C90000-0x0000020964F00000-memory.dmp

    Filesize

    2.4MB

  • memory/4844-11-0x00000209633D0000-0x00000209633D1000-memory.dmp

    Filesize

    4KB

  • memory/4844-13-0x0000020964C90000-0x0000020964F00000-memory.dmp

    Filesize

    2.4MB