Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 03:41

General

  • Target

    GlobalProtect64/.install4j/i4jruntime.jar

  • Size

    1.9MB

  • MD5

    c1b7e0b67222541df273442849cb913c

  • SHA1

    70ae5d17d48d858f27a35e7198e3ff8a517d7375

  • SHA256

    b676144fb9c9be099f82d178f578622571a365dfb257f9eeb0b25c6aa5c1b829

  • SHA512

    6e7de8ffdc735b5c823860ffaedffb2c36ee8ec5fe792040ce8cc6a58822d73b755509711af56754c823c3b1e848cda7635f151ad9da51a7d9f4ca0c82608254

  • SSDEEP

    24576:ziNHw9JMshgX2da6meOeSIQESMVcDzCPxIvxGbHTNgQq7B8k1LnvEROUN8N:ziNQQwrd3YIbpVcOvHKd8k1LvEg

Score
7/10

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\.install4j\i4jruntime.jar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1604
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

    Filesize

    46B

    MD5

    270066e8654485e2a1813fae23d2a4c7

    SHA1

    55346d3bc6acfc220e0e2304cea62bee86ff7e2d

    SHA256

    08c085ac750c6a1a269c6eae4b0f2e8753dc5c566f822bb037ddd59250dfa4d0

    SHA512

    aec1073b595071ab8fa602c2dd03e9f067282234efe5baaec7df914ca7549b212982634804aa423bf6039a2c41c8d8179424e86f327d18bc2231b443c458fbb7

  • memory/1604-2-0x0000025C57AA0000-0x0000025C57D10000-memory.dmp

    Filesize

    2.4MB

  • memory/1604-12-0x0000025C562A0000-0x0000025C562A1000-memory.dmp

    Filesize

    4KB

  • memory/1604-13-0x0000025C57AA0000-0x0000025C57D10000-memory.dmp

    Filesize

    2.4MB