8d03814dcd5e2eca422306883bcdad7a232e9e083b81349f868f1f5d70a1681f

Resubmissions

25-06-2024 05:52

240625-gkzfgstcrd 7

Analysis

max time kernel
138s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Library/dyn4j.jar
Size

361KB
MD5

a3dd06111bdc11bc4575845dc2fcc8f4
SHA1

86b0aeeceeb4e6aaf32f290784bdf5c690a27d43
SHA256

959539ea9621b1b35d866bc1ca2062de38daa1a3f49c7ea22d5b138671c38945
SHA512

ec709417cc92fdba8e8cd1e8f4b31da03967c8ef3ad1ee6068d25141a644eb7fb83beb0753bcbac9b83fcf0491621a50a9207a2352c3dabefdbf045f02e354ec
SSDEEP

6144:EMMSwh05ZVhcmf2pKuiIai+BWOzfN2Qz8OLiUfhWmFFLkHrKys7u8Qpg:5A0Xncc2dkXrN2Q3LH5VkjsqC

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1644	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1644	1624	java.exe	81
PID 1624 wrote to memory of 1644	1624	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Library\dyn4j.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
bc08996ead693562f6af381b73eeba15

SHA1
cfec633c944c2b825139cf14e737f0b8e2ceac36

SHA256
7112041faff403f823a20a323d51f352adf593450381db9d7968b10ec9f90a2e

SHA512
a54fc6dda5733aeebd607a1ea291edbdf1f72e0140eba68e03c152b501ae5b70ceeaebb7ac28e62f194b054344e8cf0ceffed953a635b9bc5047e680d55fa9c4

Download Submit
memory/1624-2-0x000001FE3ED00000-0x000001FE3EF70000-memory.dmp

Filesize
2.4MB

Download
memory/1624-13-0x000001FE3D420000-0x000001FE3D421000-memory.dmp

Filesize
4KB

Download
memory/1624-14-0x000001FE3ED00000-0x000001FE3EF70000-memory.dmp

Filesize
2.4MB

Download