8d03814dcd5e2eca422306883bcdad7a232e9e083b81349f868f1f5d70a1681f

Resubmissions

25/06/2024, 05:52

240625-gkzfgstcrd 7

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Library/connector-api.jar
Size

35KB
MD5

ec91623be533b70ef73690ea540e7000
SHA1

a5cee35dc703a9d9ea305cc3f4a2baa7c4919145
SHA256

22f801b1fff9c1f84090085b935e024861f555dec06b33dc2c85d14dacad1a5f
SHA512

7aaf55664f0240655fc1d36582c6851003f4cdb1803f4cf813183a9179e1c6a567e4ad3f47af8e441a03bfddcbc86a815c17d2612dba725cdb507e8445574c92
SSDEEP

768:cSFzdIAUDDsofyGCySf3RkRtmz8+7JCaThmqN1M2oURrVQh4+:rxU5yGCyGhkRg8yCaTwA1pzpK

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4840	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4840	952	java.exe	89
PID 952 wrote to memory of 4840	952	java.exe	89

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Library\connector-api.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
de4fca5c11e7930237735fd2f856f06e

SHA1
de2c98741ec2b72b72ed37114b162ab2af3c649c

SHA256
703c9a017c66e9f985c18813a44f37524e851f65edc9d9ef85a98235d74cbee4

SHA512
193f15a7b348fd91ac28c15a37f7dd48bb0065c764bd8df3eac7e0eba7ba6e648cc72634943982acf000f8800a84f6f4f18951a0b13206464e441ee698fe5f4c

Download Submit
memory/952-2-0x0000025C9CA30000-0x0000025C9CCA0000-memory.dmp

Filesize
2.4MB

Download
memory/952-11-0x0000025C9B260000-0x0000025C9B261000-memory.dmp

Filesize
4KB

Download
memory/952-13-0x0000025C9CA30000-0x0000025C9CCA0000-memory.dmp

Filesize
2.4MB

Download