Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 01:36
Behavioral task
behavioral1
Sample
8fc554384f269993bde053de9811902c44135fb99e1944c5047afea9aac6ea40.jar
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
8fc554384f269993bde053de9811902c44135fb99e1944c5047afea9aac6ea40.jar
Resource
win10v2004-20240508-en
General
-
Target
8fc554384f269993bde053de9811902c44135fb99e1944c5047afea9aac6ea40.jar
-
Size
203KB
-
MD5
ef8d2de4e2983dddfe12759ba4626d20
-
SHA1
e3ce248bdcd07b23e94ce832062cf717a83334a8
-
SHA256
8fc554384f269993bde053de9811902c44135fb99e1944c5047afea9aac6ea40
-
SHA512
6d956b3e536fb7227c7bcb9d2beeaac9e64fae4c60e32b95772201d0c68b962936104fba7b57ef57e82c02d193b8200539a55e69ec95a4f7d1fcfee331203280
-
SSDEEP
3072:yVeoCg5sL1zElp9IsdQffd3qrNMVMYBJk4ubY+tqtPwzrLQBAWfTy3KNY:8L61z29/dHpMVMYBqN0JIzr0qWfTxY
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 1724 wrote to memory of 228 1724 java.exe icacls.exe PID 1724 wrote to memory of 228 1724 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\8fc554384f269993bde053de9811902c44135fb99e1944c5047afea9aac6ea40.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD52614c316a60d16c8007b3e7c795608c7
SHA188539d0438bbbcf99955a06e1da6faad68f62616
SHA25625f1b040c1d5f9b6ad2bc22809a58e2e739833b2940f996e537ae9460b585911
SHA512ed37d7c7e72dbbb044090c82f7005eb4c3f08d631d80d6506b0366fbb7a77c76b291b8088d863de95d9e8123c4b66da1fb52cec698bfd9ff34b99506953e94d8