Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 09:50
Static task
static1
Behavioral task
behavioral1
Sample
5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar
Resource
win10v2004-20240508-en
General
-
Target
5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar
-
Size
481KB
-
MD5
11dec5e1d8b13456cd7e0ccb966fe12c
-
SHA1
0c5ea4abbafa47010d529b2736a54b09da4cad29
-
SHA256
5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc
-
SHA512
a397c58ea60d12a45b295d8a7e85f3d5973ce836c9df97f7b5194020e6043a62d74cf2d521d1ff2d523dc0d60b0eb1f648a08ccfc7bc83b4fa1b769528da638a
-
SSDEEP
12288:SVlCHKeQSPE4dP/I5FsRb5h3pCy1tEARGuJKcc:SHCHlrnIYxo0Gu4
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1728 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1728 2160 java.exe 82 PID 2160 wrote to memory of 1728 2160 java.exe 82
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\5595c1dc3d2e51a9aa52283e601b92abfd878a6ca694d548f0bda140d60d48cc.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD575134d9c3108d8f3f975fcac03840caa
SHA16e2a8a4c9c9d2dbfcb3434f73313ef4c7261bf44
SHA256fbca824b52930f8feb15a6115524f41c50f6394cf7418735f92a04db59fbc964
SHA5121f79b36cf8f14ce7af455a0ddfe627bc642701a87282847a06dc65f131e93b2a0c81ca4e6cfafa1d1d172c8b0710f509945056fdfbd34083d446ba2ff5c36e16