e17e03796f07a79228e86920a21cf1a7dd568e7c1723b65167346959b1517e12

Resubmissions

15/06/2024, 21:40

240615-1jj4ysvhjh 7

15/06/2024, 21:37

240615-1gg7kszaln 7

Analysis

max time kernel
0s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15/06/2024, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

[DL]-Breeze-Forge-Cracked.jar
Size

6.4MB
MD5

0558e393c43a6a62b97934db9cca3cd9
SHA1

fce58385bcb487ff3ba4700402aad893a1bbfd75
SHA256

e17e03796f07a79228e86920a21cf1a7dd568e7c1723b65167346959b1517e12
SHA512

6c0182355e1b95470e66bc924360a95e76584dfe4edb3df59775f452eb3a09f55957a8192e4ea70903d2d924d649c18f68d3e6408519dfb7f151c66c0cf43526
SSDEEP

98304:97J+n9DXUDAiGRtLc2xMEkr594/EqqfdpZkzkZz0liAIxiRuf7a0KSgT07Y9ZKQ:9V+9DGA/MEkX4bO4Wz0liAI2c7+TRKQ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
32	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 32	712	java.exe	73
PID 712 wrote to memory of 32	712	java.exe	73

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\[DL]-Breeze-Forge-Cracked.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
057ecb72c419ca2bde28b3c312af7d0d

SHA1
be08026d8257236a9d020687ebfacfab16e1c78d

SHA256
43605b5d8cb95b263d08f4dadf4e8e93cdc1dceb2747a140a41c25f645d7bf53

SHA512
12a1e0af9361f70589d9adbcddf50b810da1a144fdaa8a0b76430c91e35e34325fb03a8b145abeeab3730afeef2907596208a234662dc5de17e66d4839323152

Download Submit
memory/712-2-0x0000022285B00000-0x0000022285D70000-memory.dmp

Filesize
2.4MB

Download
memory/712-12-0x0000022285AE0000-0x0000022285AE1000-memory.dmp

Filesize
4KB

Download
memory/712-13-0x0000022285B00000-0x0000022285D70000-memory.dmp

Filesize
2.4MB

Download