Analysis

  • max time kernel
    93s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 12:31

General

  • Target

    macjihuo-2022/micool_macconfig/configfile/micool/plugins/mymap.jar

  • Size

    4KB

  • MD5

    b5e49c56f85542bc19b14af11eb10d60

  • SHA1

    dc104acd2b3c83474f04b975f882a43017bbc2b2

  • SHA256

    48f627919c46ec345119b05afbd18b2a443d47223533f21a64792302ffcd223d

  • SHA512

    30430bb87e1201c17f760f822c4c670c7b283e9cde56a2737da2ab1531f7634bc2f0034e3eef11f91bc1af52f8a80f598e9233a289566e0d95e1f5d48d979f97

  • SSDEEP

    96:ZnOG4zI+06qc5t762MDaLFlFDz5e32NULTeDAjC4wK1I0XzK:ZOEHBc5t7g+PAqULTLHwsI4K

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\macjihuo-2022\micool_macconfig\configfile\micool\plugins\mymap.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    c68a7a38a13419bc19a05e545bd3ce1f

    SHA1

    6996923852cb025b246beac7381dd2a2e0341b5a

    SHA256

    795cf88f00806d2ffa38ccb7eeb6c295f7e834006d82045a7ce591f11b5052b6

    SHA512

    9dc4c142f12451d5104dae05ebf188d918af70ee4870feaff42db7a5cbe212377eb5765c6ef24c94698315836e0727ff28469631ec60a904c41dcc6169351571

  • memory/5036-2-0x0000023DAB250000-0x0000023DAB4C0000-memory.dmp

    Filesize

    2.4MB

  • memory/5036-12-0x0000023DA9BF0000-0x0000023DA9BF1000-memory.dmp

    Filesize

    4KB

  • memory/5036-13-0x0000023DAB250000-0x0000023DAB4C0000-memory.dmp

    Filesize

    2.4MB