67edf175321f92df454c58fc64babaf1905a2843b0fe7105a3d5c6146c0e9898

Analysis

max time kernel
122s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/.install4j/i4jruntime.jar
Size

1.9MB
MD5

c1b7e0b67222541df273442849cb913c
SHA1

70ae5d17d48d858f27a35e7198e3ff8a517d7375
SHA256

b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829
SHA512

6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254
SSDEEP

24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3664	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3664	2984	java.exe	93
PID 2984 wrote to memory of 3664	2984	java.exe	93

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4jruntime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
068c5001a7e2a46d760cd7fbdf45db86

SHA1
fea1f5a468382dc9221ddbb0828aafcd17ab86be

SHA256
9ce7fc71db3943123c48945de078df34306e2a64b31fda59d09407524fb71436

SHA512
93ff503e3ff965161acbde55669060857755d617bf63fa7ac778ecf1d87813bd204ced6c9297d666df277cc694431ba67866a82f3ebc8989339a61292d98d604

Download Submit
memory/2984-2-0x000001AE61310000-0x000001AE61580000-memory.dmp

Filesize
2.4MB

Download
memory/2984-12-0x000001AE5FA40000-0x000001AE5FA41000-memory.dmp

Filesize
4KB

Download
memory/2984-13-0x000001AE61310000-0x000001AE61580000-memory.dmp

Filesize
2.4MB

Download