0d76ad914a48b69686ddb5f429635c51eb7b9b9003b1fd89fd19c9a532c92fe9

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
raven-b4-deobf.jar
Size 716KB
Sample240630-sstqrazdmb
SHA256 ab10e7851d77d6e09bdcdbbb992dabc41b9dfabf27e8ae74c6fdcf986ce2c498
MD5 a02c0ce13e8c9cc7aef996016a25181d
SHA1 d11a39f761f50d9f9779d14179be07d0d8d2018d
SHA512 c37056866269c268c9ca0d2816bdc5378e7da02721bda8f29c7e997623f81151810beb815715ebf7e6608671c10605d71aeda16455bb9899ffe7302150bc59a7
SSDEEP 12288:3BW/HcYok+jb+N4CoOt42Oj8nbHSkhxx89ehSH7UWf:Q/HcYoNjb84VOvy8bHVPx89eUrf
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1952	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1952	4816	java.exe	82
PID 4816 wrote to memory of 1952	4816	java.exe	82

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\raven-b4-deobf.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 7ba9963a0baeb79cf13fbdb24bee38b80b5049bce0c52dca608914b2b576b942
MD5 8130f286dd44658eddec8ca769b7fe21
SHA1 224a66a0ca778530b47fe0bbaf200a0dcf100242
SHA512 1c2de0312ed233fa2e6e58e53e9b54c658f2b479d33f0551f210d02242798db9a64704c876a28b00aafdc6e4b113e7f9e6bd45600e8dfe864585c482ad00eb23
MD5 SHA1 SHA512

Submit Download

memory/4816-2-0x0000019F80000000-0x0000019F80270000-memory.dmp

Download

memory/4816-12-0x0000019FFA330000-0x0000019FFA331000-memory.dmp

Download

memory/4816-13-0x0000019F80000000-0x0000019F80270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads