26eba4ba23eb76fda50e2197989b4acc570717907b9333c67f122504c379cc35

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

world-downloader.jar
Size

13.3MB
MD5

79230998e545a82c339dcb4a067c0c96
SHA1

30e60fe68c973ed13028cb851720293b00bbe792
SHA256

26eba4ba23eb76fda50e2197989b4acc570717907b9333c67f122504c379cc35
SHA512

ec8e896f995cac1dc699db191bfd1015b5e2f9db5b6fc2d2a02a949010265747a397a87cce428afed567c53c823a1e2902df490861d9c422d2b64856e30bfd95
SSDEEP

196608:Z7xfxAe9wyhqAxuOIB9VbdmXxxRL5zVXAkutqyNVAxz2ZDnvGSU5IWxJzAPv8WB:Z7xl72RdbkXdbAkiNGEGX6WxJzAX8WB

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2532	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2532	3048	java.exe	85
PID 3048 wrote to memory of 2532	3048	java.exe	85

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\world-downloader.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
a0d146291e41d93542b014b4128fb158

SHA1
42315460e3a8e3f32f2a8438e179be0c11315bd0

SHA256
aeb2091638c09b334e005a465296f68ebb0eeec6585ace0cd8b61dcbffd8b732

SHA512
9fcbf493ebd13aa85d70b07e4bd8933c54b54e3716ef861dbc00f663a79868788f0be5a83c1734def61c4adf18db3c01e7343caddf69163d08d1d2e5442686ff

Download Submit
memory/3048-2-0x0000029590DA0000-0x0000029591010000-memory.dmp

Filesize
2.4MB

Download
memory/3048-13-0x000002958F390000-0x000002958F391000-memory.dmp

Filesize
4KB

Download
memory/3048-14-0x0000029590DA0000-0x0000029591010000-memory.dmp

Filesize
2.4MB

Download