095b733c852abc0104a6e1d2d91f718d35d53f25aa4fefccea357066db5fc576

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ExcellentShop-4.10.0.jar
Size

616KB
MD5

0dcb653de5d55764057f7cb86e15b8b8
SHA1

167d1953d250919524e5aee7e278bc2e111df1ee
SHA256

095b733c852abc0104a6e1d2d91f718d35d53f25aa4fefccea357066db5fc576
SHA512

9c51341a57d923e2a9a122d3096f792ae0675b34b15a87de2ba9982702dbde1f0700f0e1e9e6ff4c4048a4ae9f87e17ec49e79872930979ea542296b4093dddb
SSDEEP

12288:MqM64aTjG3+zbsHPwyJxKuzU9Jhb0+PSoMfgKHH8vhAkvHzAGXiyraI33O0BsL:MqMbh3KenKcU97oGwgK8vhFlXrr62sL

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2548	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 2548	4196	java.exe	91
PID 4196 wrote to memory of 2548	4196	java.exe	91

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ExcellentShop-4.10.0.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,15142778360084620907,1763097090506261076,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
74b120f0740a93ceedf080e5b8b5262e

SHA1
3109b09011f5688a7c4638d48a1ef4ee7571d00a

SHA256
d0356af14f6930979c0b9ee9eef45f11cce2b9ba33cba4c5009cda735f3f69e2

SHA512
99e6510ac9e074c5118f8be14a8e023b46c70f10a7d3f937eb3dd92a8292738816bae730a752927d817383cfba1442fcb46ec9e20c47c226cab75b916c3dbb24

Download Submit
memory/4196-2-0x0000025BD9CB0000-0x0000025BD9F20000-memory.dmp

Filesize
2.4MB

Download
memory/4196-12-0x0000025BD83E0000-0x0000025BD83E1000-memory.dmp

Filesize
4KB

Download
memory/4196-13-0x0000025BD9CB0000-0x0000025BD9F20000-memory.dmp

Filesize
2.4MB

Download