7909209bc914457c3d1d48f9441241b17b32c4ccba630e44c6460ad765a86308

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GlobalProtect64/.install4j/i4jruntime.jar
Size

1.9MB
MD5

c1b7e0b67222541df273442849cb913c
SHA1

70ae5d17d48d858f27a35e7198e3ff8a517d7375
SHA256

b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829
SHA512

6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254
SSDEEP

24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2772 icacls.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

java.exe

description pid process target process

PID 1604 wrote to memory of 2772 1604 java.exe icacls.exe
PID 1604 wrote to memory of 2772 1604 java.exe icacls.exe

pid	process
2772	icacls.exe

description	pid	process	target process
PID 1604 wrote to memory of 2772	1604	java.exe	icacls.exe
PID 1604 wrote to memory of 2772	1604	java.exe	icacls.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4jruntime.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
270066e8654485e2a1813fae23d2a4c7

SHA1
55346d3bc6acfc220e0e2304cea62bee86ff7e2d

SHA256
08c085ac750c6a1a269c6eae4b0f2e8753dc5c566f822bb037ddd59250dfa4d0

SHA512
aec1073b595071ab8fa602c2dd03e9f067282234efe5baaec7df914ca7549b212982634804aa423bf6039a2c41c8d8179424e86f327d18bc2231b443c458fbb7

Download Submit
memory/1604-2-0x0000025C57AA0000-0x0000025C57D10000-memory.dmp

Filesize
2.4MB

Download
memory/1604-12-0x0000025C562A0000-0x0000025C562A1000-memory.dmp

Filesize
4KB

Download
memory/1604-13-0x0000025C57AA0000-0x0000025C57D10000-memory.dmp

Filesize
2.4MB

Download