e26e137c8bf211515f8fdbcdd0139650da944f91f6dde1f3dd0eb41a5dc5f19a

Analysis

max time kernel
82s
max time network
103s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
04/07/2024, 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rise.jar
Size

44.2MB
MD5

cbd1fe16286ba11752c37cdc7ab7efd6
SHA1

2efdc25e99edaac71e32c60289004a98575a722e
SHA256

e26e137c8bf211515f8fdbcdd0139650da944f91f6dde1f3dd0eb41a5dc5f19a
SHA512

39d90a4e0164b41b320e74b7db023a998919ed406c8cdace4aa4764b9e0a7b33c72e8be67b11bff6aabc5ad116742b242c57237d887538c6c438eeeddf02d84c
SSDEEP

786432:eC4+8rqTcAcjxX+FJCSCuDYc6QLZbXZze+L4z:eX+OqQAY+FJLv0iNdze+L4z

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1912	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1912	1468	java.exe	71
PID 1468 wrote to memory of 1912	1468	java.exe	71

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Rise.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
368e5a2712149c34589976009674b188

SHA1
76c539ce426fe54b01c6aa5c80a54ab412df88b8

SHA256
6958fed6cd008fdaa3cf889ec7362da222a11cbb0f651a6b83c36aae046beba8

SHA512
4e98b540ab50ac81dc1fd039d92a9bbcbb9a6ca1edc6a0c150436ee35c5f7fb3eb1297606428082eacfbe275e0a885c2752977d49d1683c111fa815a3c548517

Download Submit
memory/1468-2-0x000001A930F90000-0x000001A931200000-memory.dmp

Filesize
2.4MB

Download
memory/1468-13-0x000001A930F70000-0x000001A930F71000-memory.dmp

Filesize
4KB

Download
memory/1468-14-0x000001A930F90000-0x000001A931200000-memory.dmp

Filesize
2.4MB

Download