8d03814dcd5e2eca422306883bcdad7a232e9e083b81349f868f1f5d70a1681f

Resubmissions

25/06/2024, 05:52

240625-gkzfgstcrd 7

Analysis

max time kernel
47s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Library/gson.jar
Size

226KB
MD5

5134a2350f58890ffb9db0b40047195d
SHA1

751f548c85fa49f330cecbb1875893f971b33c4e
SHA256

2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32
SHA512

c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a
SSDEEP

3072:2DiL6hR+wm60gqZjJhqo2M04r7bv1XMrMxw1rl1rwj+Bmd6dYBmkW1eIjEmFdbl6:bq0jSi2Qi1B1Cay6dYBUwmPxLe3

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3068	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3068	2904	java.exe	81
PID 2904 wrote to memory of 3068	2904	java.exe	81

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Library\gson.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c3dcd61ed52d5634a77acd51a9eb81dd

SHA1
c0ed25cd1ab69d1884966378d677b3328c0bf4d5

SHA256
222486db31d501174cd36543972b7994a8ee3d79f96d2fa512e81d3db9596659

SHA512
77a33aedb2230c9fd9587860183816c8d993e148a0c173d1e9389d3283bb8efef2162d35dfd5f4d29d3f47d8ad8786e82502e5e5e07a4ab7b577328ea5973d09

Download Submit
memory/2904-2-0x00000199868E0000-0x0000019986B50000-memory.dmp

Filesize
2.4MB

Download
memory/2904-12-0x0000019985020000-0x0000019985021000-memory.dmp

Filesize
4KB

Download
memory/2904-13-0x00000199868E0000-0x0000019986B50000-memory.dmp

Filesize
2.4MB

Download