Analysis

  • max time kernel
    135s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-06-2024 12:31

General

  • Target

    macjihuo-2022/micool_macconfig/configfile/micool2018.jar

  • Size

    1002KB

  • MD5

    a577fe434dcf668222505d75eb4a9b58

  • SHA1

    3323d5d0b82e716609808090d3dc7cb3198b8c4b

  • SHA256

    da958394d79615d0d0d31190ed0b63b3959901067db72dfba223c7e3a844c8bc

  • SHA512

    e47be505914db6c93a196edf10043e6563a557d926210a7dd4b92376c1fb8ac74a9838270d9e85786d80b11847781fa000952a124400187a2c5cc22d0ca62052

  • SSDEEP

    12288:YUsNQ8ZLJ20ksC7Qy0qNS+Kkp9cM1CkpClVAoDqnWicYAi4DaqXCKPTTZysORKb:YUb8ZLJmQfDEv6DtiWrtXuZkfYcb

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\macjihuo-2022\micool_macconfig\configfile\micool2018.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:3916
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3744,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:8
    1⤵
      PID:1972

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

      Filesize

      46B

      MD5

      779c14896efbc28ea0d72302f89bbb76

      SHA1

      0d2cb7e198c216d0f431620b03a90b6cff09e5db

      SHA256

      6431b08f19052f59a65f792ef80e8df6de98bb8b9c1ca2b224d9681e24baee34

      SHA512

      5faf6d259ab7cb929ba48594b30ef1f0a8924f0e5dd29f8cea090758533cf9cb8ac525cf92f0af683052a8b7a06279d835725aa7519a066089a12ecb9a177e73

    • memory/624-2-0x0000027369800000-0x0000027369A70000-memory.dmp

      Filesize

      2.4MB

    • memory/624-11-0x00000273697E0000-0x00000273697E1000-memory.dmp

      Filesize

      4KB

    • memory/624-15-0x0000027369A70000-0x0000027369A80000-memory.dmp

      Filesize

      64KB

    • memory/624-17-0x00000273697E0000-0x00000273697E1000-memory.dmp

      Filesize

      4KB

    • memory/624-18-0x0000027369800000-0x0000027369A70000-memory.dmp

      Filesize

      2.4MB

    • memory/624-19-0x0000027369A70000-0x0000027369A80000-memory.dmp

      Filesize

      64KB