97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9

General

Target

97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9.jar
Size

432KB
MD5

8ec9eb589dc78c7e0ad9c8155027a133
SHA1

f4cc5469b945ce8f4c5d266375c28f97636479ff
SHA256

97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9
SHA512

0044e07c000634a043aae2b9f42df7f9f1d0dba2462207663c7f0e9e322cb732b19ab0e7f1fdd653b587c0ce19f5efc93fb7e630ff3477e5e98bcb652f723a1c
SSDEEP

6144:VwhA+Jd+Z+qYYQJXELxEG1E3RjdZO8uk/VSADdEwyOygQc8axuk9:VwC+Jd+Q1hENLE3JdU8fsg5XQc8axf9

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3348 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1736 wrote to memory of 3348 1736 java.exe icacls.exe
PID 1736 wrote to memory of 3348 1736 java.exe icacls.exe

pid	process
3348	icacls.exe

description	pid	process	target process
PID 1736 wrote to memory of 3348	1736	java.exe	icacls.exe
PID 1736 wrote to memory of 3348	1736	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:3348

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
a901c8eae5734bffd9ecec71751aa0bf

SHA1
a5105cb847ecbe9334fe84a42640aca9133d6aa4

SHA256
8f6d4bc5173c40ce9cf9d5fd7097f9d43bebb6ba358040b24adea3c134826f39

SHA512
10b6204bd711ec868da060c4bb0b2933e62a318019a040bbdf3a411443546b2bf88b0f917d455b17c511d08e1d685faca88a2be695cf3bcbf7111dd500ce52c4

Download Submit
memory/1736-2-0x0000019739F50000-0x000001973A1C0000-memory.dmp

Filesize
2.4MB

Download
memory/1736-17-0x000001973A1E0000-0x000001973A1F0000-memory.dmp

Filesize
64KB

Download
memory/1736-16-0x000001973A1D0000-0x000001973A1E0000-memory.dmp

Filesize
64KB

Download
memory/1736-15-0x000001973A1C0000-0x000001973A1D0000-memory.dmp

Filesize
64KB

Download
memory/1736-20-0x000001973A1F0000-0x000001973A200000-memory.dmp

Filesize
64KB

Download
memory/1736-21-0x000001973A200000-0x000001973A210000-memory.dmp

Filesize
64KB

Download
memory/1736-25-0x000001973A220000-0x000001973A230000-memory.dmp

Filesize
64KB

Download
memory/1736-27-0x000001973A230000-0x000001973A240000-memory.dmp

Filesize
64KB

Download
memory/1736-24-0x000001973A210000-0x000001973A220000-memory.dmp

Filesize
64KB

Download
memory/1736-30-0x000001973A240000-0x000001973A250000-memory.dmp

Filesize
64KB

Download
memory/1736-31-0x000001973A250000-0x000001973A260000-memory.dmp

Filesize
64KB

Download
memory/1736-32-0x0000019738670000-0x0000019738671000-memory.dmp

Filesize
4KB

Download
memory/1736-34-0x0000019738670000-0x0000019738671000-memory.dmp

Filesize
4KB

Download
memory/1736-42-0x0000019739F50000-0x000001973A1C0000-memory.dmp

Filesize
2.4MB

Download
memory/1736-46-0x000001973A290000-0x000001973A2A0000-memory.dmp

Filesize
64KB

Download
memory/1736-45-0x000001973A280000-0x000001973A290000-memory.dmp

Filesize
64KB

Download
memory/1736-44-0x000001973A270000-0x000001973A280000-memory.dmp

Filesize
64KB

Download
memory/1736-43-0x000001973A260000-0x000001973A270000-memory.dmp

Filesize
64KB

Download
memory/1736-51-0x000001973A2A0000-0x000001973A2B0000-memory.dmp

Filesize
64KB

Download
memory/1736-50-0x000001973A1D0000-0x000001973A1E0000-memory.dmp

Filesize
64KB

Download
memory/1736-49-0x000001973A1C0000-0x000001973A1D0000-memory.dmp

Filesize
64KB

Download
memory/1736-55-0x000001973A2C0000-0x000001973A2D0000-memory.dmp

Filesize
64KB

Download
memory/1736-56-0x000001973A1F0000-0x000001973A200000-memory.dmp

Filesize
64KB

Download
memory/1736-54-0x000001973A2B0000-0x000001973A2C0000-memory.dmp

Filesize
64KB

Download
memory/1736-53-0x000001973A1E0000-0x000001973A1F0000-memory.dmp

Filesize
64KB

Download
memory/1736-61-0x000001973A2E0000-0x000001973A2F0000-memory.dmp

Filesize
64KB

Download
memory/1736-60-0x000001973A2D0000-0x000001973A2E0000-memory.dmp

Filesize
64KB

Download
memory/1736-59-0x000001973A200000-0x000001973A210000-memory.dmp

Filesize
64KB

Download
memory/1736-65-0x0000019738670000-0x0000019738671000-memory.dmp

Filesize
4KB

Download
memory/1736-66-0x000001973A210000-0x000001973A220000-memory.dmp

Filesize
64KB

Download
memory/1736-67-0x000001973A220000-0x000001973A230000-memory.dmp

Filesize
64KB

Download
memory/1736-69-0x000001973A230000-0x000001973A240000-memory.dmp

Filesize
64KB

Download
memory/1736-70-0x000001973A240000-0x000001973A250000-memory.dmp

Filesize
64KB

Download
memory/1736-71-0x000001973A250000-0x000001973A260000-memory.dmp

Filesize
64KB

Download
memory/1736-73-0x000001973A270000-0x000001973A280000-memory.dmp

Filesize
64KB

Download
memory/1736-74-0x000001973A280000-0x000001973A290000-memory.dmp

Filesize
64KB

Download
memory/1736-72-0x000001973A260000-0x000001973A270000-memory.dmp

Filesize
64KB

Download
memory/1736-77-0x000001973A2F0000-0x000001973A300000-memory.dmp

Filesize
64KB

Download
memory/1736-76-0x000001973A290000-0x000001973A2A0000-memory.dmp

Filesize
64KB

Download
memory/1736-78-0x000001973A2A0000-0x000001973A2B0000-memory.dmp

Filesize
64KB

Download
memory/1736-79-0x000001973A2B0000-0x000001973A2C0000-memory.dmp

Filesize
64KB

Download
memory/1736-80-0x000001973A2C0000-0x000001973A2D0000-memory.dmp

Filesize
64KB

Download
memory/1736-82-0x000001973A2E0000-0x000001973A2F0000-memory.dmp

Filesize
64KB

Download
memory/1736-81-0x000001973A2D0000-0x000001973A2E0000-memory.dmp

Filesize
64KB

Download
memory/1736-83-0x000001973A2F0000-0x000001973A300000-memory.dmp

Filesize
64KB

Download
memory/1736-85-0x000001973A300000-0x000001973A310000-memory.dmp

Filesize
64KB

Download
memory/1736-86-0x000001973A300000-0x000001973A310000-memory.dmp

Filesize
64KB

Download
memory/1736-88-0x000001973A310000-0x000001973A320000-memory.dmp

Filesize
64KB

Download
memory/1736-90-0x000001973A310000-0x000001973A320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing