14d185f423388e146296c7f5ae1777185ec48f08e56da3fa1d7920f9290f9606

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14d185f423388e146296c7f5ae1777185ec48f08e56da3fa1d7920f9290f9606.jar
Size 419KB
Sample240611-sxm4rssdjm
SHA256 14d185f423388e146296c7f5ae1777185ec48f08e56da3fa1d7920f9290f9606
MD5 d8fbed1f1b909c332d385b0afc4c9c7e
SHA1 814124103fdf30a2d7dc79bb408f7bf0c20acb70
SHA512 fc9557cb308bdec04f26e0b7ee53ae4f01bef719af41706b737f4603b3c320c792d794f98a4325ff8a896730542966d6abcfc980eafe3e08d376370c94b0e217
SSDEEP 6144:cSZccKa24v060Om3+rzK5tnSz63cwqK3DK64OSKK6YlYjhkN6992J2mfLUQz:c54pDjzK5tnAI9P3DByQYIkMLIJfvz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3532	icacls.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe
Token: SeIncreaseQuotaPrivilege	3164	wmic.exe
Token: SeSecurityPrivilege	3164	wmic.exe
Token: SeTakeOwnershipPrivilege	3164	wmic.exe
Token: SeLoadDriverPrivilege	3164	wmic.exe
Token: SeSystemProfilePrivilege	3164	wmic.exe
Token: SeSystemtimePrivilege	3164	wmic.exe
Token: SeProfSingleProcessPrivilege	3164	wmic.exe
Token: SeIncBasePriorityPrivilege	3164	wmic.exe
Token: SeCreatePagefilePrivilege	3164	wmic.exe
Token: SeBackupPrivilege	3164	wmic.exe
Token: SeRestorePrivilege	3164	wmic.exe
Token: SeShutdownPrivilege	3164	wmic.exe
Token: SeDebugPrivilege	3164	wmic.exe
Token: SeSystemEnvironmentPrivilege	3164	wmic.exe
Token: SeRemoteShutdownPrivilege	3164	wmic.exe
Token: SeUndockPrivilege	3164	wmic.exe
Token: SeManageVolumePrivilege	3164	wmic.exe
Token: 33	3164	wmic.exe
Token: 34	3164	wmic.exe
Token: 35	3164	wmic.exe
Token: 36	3164	wmic.exe
Token: SeIncreaseQuotaPrivilege	3036	wmic.exe
Token: SeSecurityPrivilege	3036	wmic.exe
Token: SeTakeOwnershipPrivilege	3036	wmic.exe
Token: SeLoadDriverPrivilege	3036	wmic.exe
Token: SeSystemProfilePrivilege	3036	wmic.exe
Token: SeSystemtimePrivilege	3036	wmic.exe
Token: SeProfSingleProcessPrivilege	3036	wmic.exe
Token: SeIncBasePriorityPrivilege	3036	wmic.exe
Token: SeCreatePagefilePrivilege	3036	wmic.exe
Token: SeBackupPrivilege	3036	wmic.exe
Token: SeRestorePrivilege	3036	wmic.exe
Token: SeShutdownPrivilege	3036	wmic.exe
Token: SeDebugPrivilege	3036	wmic.exe
Token: SeSystemEnvironmentPrivilege	3036	wmic.exe
Token: SeRemoteShutdownPrivilege	3036	wmic.exe
Token: SeUndockPrivilege	3036	wmic.exe
Token: SeManageVolumePrivilege	3036	wmic.exe
Token: 33	3036	wmic.exe
Token: 34	3036	wmic.exe
Token: 35	3036	wmic.exe
Token: 36	3036	wmic.exe
Token: SeIncreaseQuotaPrivilege	3036	wmic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4536	java.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 3532	4536	java.exe	81
PID 4536 wrote to memory of 3532	4536	java.exe	81
PID 4536 wrote to memory of 3164	4536	java.exe	90
PID 4536 wrote to memory of 3164	4536	java.exe	90
PID 4536 wrote to memory of 3036	4536	java.exe	92
PID 4536 wrote to memory of 3036	4536	java.exe	92
PID 4536 wrote to memory of 4832	4536	java.exe	94
PID 4536 wrote to memory of 4832	4536	java.exe	94
PID 4536 wrote to memory of 2012	4536	java.exe	96
PID 4536 wrote to memory of 2012	4536	java.exe	96

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\14d185f423388e146296c7f5ae1777185ec48f08e56da3fa1d7920f9290f9606.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3532
- C:\Windows\System32\Wbem\wmic.exe
  wmic CPU get ProcessorId
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get name
  2⤵
  PID:4832
- C:\Windows\System32\Wbem\wmic.exe
  wmic csproduct get UUID
  2⤵
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 6dfb242fe64419440c86f303d7cd5d55095d1955b8102200791b4c38a7a778fe
MD5 fb8c5fe897f3a62a39cc41f7aff3fed5
SHA1 55e7944165fea9772befe6509c433b4e54c7465b
SHA512 f5591ddd6e0f5a9db857a9d3b72f45c56b7bcda87d3b84cdef4677f8b9a54f63ed3ea953be53ea2e21321cdc351d3ecc3e9097a503f26b635f18b6b26dd8bf39
MD5 SHA1 SHA512

Submit Download

memory/4536-48-0x00000225CE220000-0x00000225CE230000-memory.dmp

Download

memory/4536-34-0x00000225CE1E0000-0x00000225CE1F0000-memory.dmp

Download

memory/4536-23-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-29-0x00000225CE1C0000-0x00000225CE1D0000-memory.dmp

Download

memory/4536-30-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-32-0x00000225CE1D0000-0x00000225CE1E0000-memory.dmp

Download

memory/4536-2-0x00000225CDF50000-0x00000225CE1C0000-memory.dmp

Download

memory/4536-36-0x00000225CE1F0000-0x00000225CE200000-memory.dmp

Download

memory/4536-38-0x00000225CE200000-0x00000225CE210000-memory.dmp

Download

memory/4536-41-0x00000225CE210000-0x00000225CE220000-memory.dmp

Download

memory/4536-22-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-45-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-63-0x00000225CDF50000-0x00000225CE1C0000-memory.dmp

Download

memory/4536-56-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-61-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-62-0x00000225CC780000-0x00000225CC781000-memory.dmp

Download

memory/4536-47-0x00000225CDF50000-0x00000225CE1C0000-memory.dmp

Download

memory/4536-70-0x00000225CE220000-0x00000225CE230000-memory.dmp

Download

memory/4536-69-0x00000225CE210000-0x00000225CE220000-memory.dmp

Download

memory/4536-68-0x00000225CE200000-0x00000225CE210000-memory.dmp

Download

memory/4536-67-0x00000225CE1F0000-0x00000225CE200000-memory.dmp

Download

memory/4536-66-0x00000225CE1E0000-0x00000225CE1F0000-memory.dmp

Download

memory/4536-65-0x00000225CE1D0000-0x00000225CE1E0000-memory.dmp

Download

memory/4536-64-0x00000225CE1C0000-0x00000225CE1D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads