Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-06-2024 11:02
Behavioral task
behavioral1
Sample
01ed21113dc9ef0fc8db1ab49021286f47c7e75eb377f24c8c57dc9b25cfcc59.jar
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
01ed21113dc9ef0fc8db1ab49021286f47c7e75eb377f24c8c57dc9b25cfcc59.jar
Resource
win10v2004-20240508-en
General
-
Target
01ed21113dc9ef0fc8db1ab49021286f47c7e75eb377f24c8c57dc9b25cfcc59.jar
-
Size
203KB
-
MD5
6466b8b6db77557217549b21d857ba28
-
SHA1
850b21f745803ca28cc4e4607e433452d1fade1e
-
SHA256
01ed21113dc9ef0fc8db1ab49021286f47c7e75eb377f24c8c57dc9b25cfcc59
-
SHA512
72a62ec8b536bdb9f5075b25166b7c1cb59cd5cf2f736e3bc28c98b57a3d86c8b2c666669e1a5309291e5551a9f758e252ba9b1cd3b99bbe49f37441d42e9230
-
SSDEEP
3072:mV2ECg5sT5LQlZ9IkZI/fd3qr9w5wYJJk4ubY+pqtvQzvL0BoWrTy/mS:Qz65LG9bZbBw5wYJqN0dozvQSWrTnS
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid Process procid_target PID 1244 wrote to memory of 4340 1244 java.exe 85 PID 1244 wrote to memory of 4340 1244 java.exe 85
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\01ed21113dc9ef0fc8db1ab49021286f47c7e75eb377f24c8c57dc9b25cfcc59.jar1⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD5561282af8bdf8bee61d8ed2b8998e564
SHA1aeeb32a5ecb34adef2772fcda441b816c7f838fe
SHA256593df569d3b3cb664994694b6e19e3a6b7c6da8e11c83c3566e743dd8f25bc96
SHA51297b92ab6f5dcd879fe6d23691a4db52ced56ec617536ade46c755db7511171b6684943946f3207ca129f7ae2df72063c1c6dd34689c57094e90b1353afe9ec82