67edf175321f92df454c58fc64babaf1905a2843b0fe7105a3d5c6146c0e9898

Resubmissions

26/07/2024, 09:06

240726-k2ts4ssbnb 10

20/06/2024, 20:05

240620-yts4havhph 10

Analysis

max time kernel
1663s
max time network
1675s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/.install4j/i4jruntime.jar
Size

1.9MB
MD5

c1b7e0b67222541df273442849cb913c
SHA1

70ae5d17d48d858f27a35e7198e3ff8a517d7375
SHA256

b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829
SHA512

6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254
SSDEEP

24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1744	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1744	1528	java.exe	84
PID 1528 wrote to memory of 1744	1528	java.exe	84

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4jruntime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
50c137153e247e10547e757bec6cfc8c

SHA1
3ce8551b230ad61cbeede8b3a91fb33bed07c01f

SHA256
a45348a2d63e5fe9c2ab1866e94b4632691e015c561aa9ed4ef97119489285b4

SHA512
e90b203ab8777ff989d5d397b0df8416a623ad0ec18a535dc316c60f995b784fd01ff95cdbd01b8be20813ac4743609202ed6563839d085873c15afb7250b05f

Download Submit
memory/1528-2-0x000002C004D90000-0x000002C005000000-memory.dmp

Filesize
2.4MB

Download
memory/1528-12-0x000002C003490000-0x000002C003491000-memory.dmp

Filesize
4KB

Download
memory/1528-13-0x000002C004D90000-0x000002C005000000-memory.dmp

Filesize
2.4MB

Download