32a80454669e0719c491133191e7e0240f9ff1b137690e0c05f5e860eaaa96ca

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a3c59cb2183778912709c2e5d1f04707_JaffaCakes118.jar
Size 2KB
Sample240613-en3k7stdqe
SHA256 32a80454669e0719c491133191e7e0240f9ff1b137690e0c05f5e860eaaa96ca
MD5 a3c59cb2183778912709c2e5d1f04707
SHA1 dec42de0b9e0950d687e4e4bd856b40601ec7fc5
SHA512 3475aa8e7b007f06b001ecb69e0396f7226b7b6593be517f9bd7a5b73cfd45dc09437566a7bee69f8767c198f85eba5614367d0ee9881fffe149b4b4b6f592fc
MD5 SHA1 SHA512

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1468	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1468	684	java.exe	91
PID 684 wrote to memory of 1468	684	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\a3c59cb2183778912709c2e5d1f04707_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:684
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4252,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b6e1e59ad9d086d12e998fe0140ea616287d917630ab96f2ce4a59b219cbf404
MD5 242cc0c67716e0a5f512d7d789e2ea32
SHA1 21671a0415e0837dda0910b2b16eaf5b86afc31f
SHA512 7f035e6df8e2ad1fd61bc95be39a128eed3798b4498f0b975666914368b5904fd76bed63ab6681eb507d5cb1a84550613151a7e767ec4966ba0026674e0350e4
MD5 SHA1 SHA512