Analysis
-
max time kernel
28s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-07-2024 15:33
Behavioral task
behavioral1
Sample
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
Resource
win11-20240508-en
General
-
Target
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar
-
Size
203KB
-
MD5
b6ca4213e6f097b3537f732a4ffd195f
-
SHA1
59539ba574ca3ad901331cfaef98977d68fc3ee0
-
SHA256
3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b
-
SHA512
ee17012dcfd98829e4a5fae7b11c7265a16ccdb3a0682968fd115b57fef10123ff9174119fbed70c2d1cd3d63eb8437ddc3f289da3652bdf1f8aac96cde5b0e1
-
SSDEEP
3072:xxXgSiFF4/9Gc/GJrulpnKtQ3aeb01TdD9KQ0rSK2WF52G8a:xhgSiFFc/4Cl4qp01Tx9+SrG8a
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 908 icacls.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2428 wrote to memory of 908 2428 java.exe 79 PID 2428 wrote to memory of 908 2428 java.exe 79
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\3eafb74de2ee510948914c85bc60f01044bae17b12055e892c1711abc20fd64b.jar1⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46B
MD56d6a5ad3b1904a6d74a209a8db436096
SHA14d324bdd289628457c0b4816cc32f5530501aaf6
SHA25659983c540c9edd18ca1d8907c251971522917f3aa169576628791b5ed3641b95
SHA5129a923f6edeee0f56fbd21b2636b3a2d8a53754ac196be38e75972107c743de380b0bd94bfabbabc3c1fd45af708a281ced4b31e5c160e640177f77bb567f36ef