7c598cc2c2b6e6bca52a6d2bd9f1dfa1fc9c14ff69d5e07178fc0d29f3820f40

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2014-04-03-FlashPack-EK-java-exploit.jar
Size

9KB
MD5

e5c7b0714c4735d4df40d55f9d73cbb1
SHA1

4fb88b4d6460fdc8d5ec329eef4f6adca0ca1764
SHA256

8e918479fc7a46f45a65d3726eae336a6b6d3c4b9b13906d2dcf7ca96ab2e02d
SHA512

b71a32bb5375ea66f6e13defb7496d1e3e1c447baf560c63fa14b85aff4dd6aa81af9aec9da9facf45a3526691caea61a149b31418b92ccedc49b44765eb375c
SSDEEP

192:765dN77Bv8JRiBDBvr6vK0i6RWiu/oI2R+bd67qXMLApRzJ1UzwNpDY+3Yy:76VBE2vQAbMqXWApRV1aMDD

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4952	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 4952	3988	java.exe	85
PID 3988 wrote to memory of 4952	3988	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\2014-04-03-FlashPack-EK-java-exploit.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
dd736033bf81ab80df4d5a4f18ec4c1a

SHA1
256fb8690b9beb9d6aa9c19bdefb7564b8ddd6bc

SHA256
7f01a62eef0c71cf27e6526ce7ec458149f04919cb29e57f3c5a0f91b7d7d8fd

SHA512
ac4586440d1701729f8a2d7de97b39e53cc89b0372375d88aedad900ad14e261fa013076e6342e8d0499acbb716479954df072aeee622a42594684095694f5d8

Download Submit
memory/3988-2-0x000001FCCB970000-0x000001FCCBBE0000-memory.dmp

Filesize
2.4MB

Download
memory/3988-12-0x000001FCCB950000-0x000001FCCB951000-memory.dmp

Filesize
4KB

Download
memory/3988-13-0x000001FCCB970000-0x000001FCCBBE0000-memory.dmp

Filesize
2.4MB

Download