c6a6035042d723b159bb952c280268f0c0809adda6025f77f8062c320718e3a9

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MCSTORM.jar
Size

5.2MB
MD5

e1def09adfcbc1fdfe01c51e3732b1d4
SHA1

6f19f306ebff3b9832522aa53c37132ddb404988
SHA256

c6a6035042d723b159bb952c280268f0c0809adda6025f77f8062c320718e3a9
SHA512

e72b13ee36d00415b68d8643c44e1e50bb025b540591d467417604bfc8c4c9e60164aee9951c83ef114db9fa26de9199ea08a0582484007164610bf9959ba94d
SSDEEP

98304:KTlOAZznnGuBLoNGwhpRB8L/xTuJ1Ypras7rW91Cou/J6qxerJ9OMCy3:K/rjBLoN7TRiL/iKhX7rWHTioKer/CI

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3604	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 3604	4516	java.exe	84
PID 4516 wrote to memory of 3604	4516	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\MCSTORM.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
7ff58201f16e1e113a996a235a46117f

SHA1
f670aff5b325e6762983e83b0babc3a131b86c6d

SHA256
fcd291337262d57f29c075b530477f5e1ecef5fba143e80eddb1ce35ae98e543

SHA512
7f15c206e5e506d31ac7846a5c76d3260290cf39169ed7efab97094337916f3c015c979858c8468a52d97d93f15fb21d6efda8fde727d07deda320b6e6da6785

Download Submit
memory/4516-2-0x000001EAE5FD0000-0x000001EAE6240000-memory.dmp

Filesize
2.4MB

Download
memory/4516-13-0x000001EAE4980000-0x000001EAE4981000-memory.dmp

Filesize
4KB

Download
memory/4516-14-0x000001EAE5FD0000-0x000001EAE6240000-memory.dmp

Filesize
2.4MB

Download