3eb57cd3c204ba1741e4500ef2566f524b10f4da23b3831f0855abcea0987649

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sorillus.jar
Size

10.1MB
MD5

f9119b4bbb55ce59f43113c71cd177f8
SHA1

1605b453fa74091f92f51691a3dd378c1b67f3fa
SHA256

3eb57cd3c204ba1741e4500ef2566f524b10f4da23b3831f0855abcea0987649
SHA512

b166ce950e2c2bd2f23fe9063656ffd31da66dbd699419a71479d52654bf4113bddd8f51392577470a6f1342cc7546f5474d0765a209ff3b01ae65074d04a650
SSDEEP

196608:oJkKjM0rT/ZiDxU/Mcd8qAbPeGme9WvhAn9QKmMCnoOqpUF:UvjM0pAUEQ/kGde9WJC9QK36oy

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2416	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2416	624	java.exe	90
PID 624 wrote to memory of 2416	624	java.exe	90

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Sorillus.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:624
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3960,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
4b1027d660dde271e1c2c565c66e452b

SHA1
f0d3ef8207faf0f7ae02c6dbbc3df89c5077a841

SHA256
cd9f78c2f41b2520923438c55512022dabb89bffa6b220fce73111b06508fa5b

SHA512
5de19592a461343b35baf0d7685e2acec7aae87d9e949cd9805a5d36dd65ea37bdd7a05dba1c583e7444e3e8cf3f84439dfcc75c74fee230b1f5d627621af079

Download Submit
memory/624-2-0x0000022900000000-0x0000022900270000-memory.dmp

Filesize
2.4MB

Download
memory/624-17-0x0000022977060000-0x0000022977061000-memory.dmp

Filesize
4KB

Download
memory/624-18-0x0000022900000000-0x0000022900270000-memory.dmp

Filesize
2.4MB

Download