4097035fd7cac64d82e5250a3a691d2985b2c4894b91c258391ee6592fc1f61a

Resubmissions

12-08-2024 17:47

240812-wdcepssark 8

Analysis

max time kernel
135s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
12-08-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Burpy/BurpLoaderKeygen.jar
Size

29KB
MD5

56a0eef3a96bf373db1298bc6cb63158
SHA1

f9fb9175a901f4fede20b9d61eb4fadafdd1feea
SHA256

1e288c686963eafc34411d4f94265eb1809492ab57a474848669eb3285a2afb3
SHA512

d6165e567c80cd04c2506f285d48fb3e2dd6d46e4eda3b9bf76c2ea585ac446807ccabc02c4f8a6bede36a8ac1d1737eab3840cfdc703123daeccd526593f492
SSDEEP

768:ccLie6lYEKyYSfk8tyPAR8NVgJMvtWHw1QgHpA:NLie6lYEKyYSfkwNY+MvtuWQgG

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4820 icacls.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

java.exe

pid process

936 java.exe
936 java.exe

pid	process
4820	icacls.exe

pid	process
936	java.exe
936	java.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

java.exe

description	pid	process	target process
PID 936 wrote to memory of 4820	936	java.exe	icacls.exe
PID 936 wrote to memory of 4820	936	java.exe	icacls.exe
PID 936 wrote to memory of 4544	936	java.exe	java.exe
PID 936 wrote to memory of 4544	936	java.exe	java.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Burpy\BurpLoaderKeygen.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
2⤵
- Modifies file permissions
PID:4820

C:\Program Files\Java\jre-1.8\bin\java.exe
"C:\Program Files\Java\jre-1.8\bin\java.exe" -version
2⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Filesize
46B

MD5
0295f5c62425699e674aa6490cc0255c

SHA1
837e5ed9e2ee217047d3e0281c5b523757baea44

SHA256
d1067f40ed5cb1bebe823209285136913d683a294521e061c95c8f6351cc3346

SHA512
3b82db2d317072a0a8a60f2376a23c379937c10996414946ceeeacd4ff8569fdc2bdb31271d2073c87d093bc21044c68a7197ec3ec410113fb351664aeb95b44

Download Submit
memory/936-65-0x0000027A31240000-0x0000027A31250000-memory.dmp

Filesize
64KB

Download
memory/936-99-0x0000027A31210000-0x0000027A31220000-memory.dmp

Filesize
64KB

Download
memory/936-18-0x0000027A31190000-0x0000027A311A0000-memory.dmp

Filesize
64KB

Download
memory/936-23-0x0000027A311B0000-0x0000027A311C0000-memory.dmp

Filesize
64KB

Download
memory/936-22-0x0000027A311A0000-0x0000027A311B0000-memory.dmp

Filesize
64KB

Download
memory/936-24-0x0000027A311C0000-0x0000027A311D0000-memory.dmp

Filesize
64KB

Download
memory/936-26-0x0000027A311D0000-0x0000027A311E0000-memory.dmp

Filesize
64KB

Download
memory/936-29-0x0000027A311E0000-0x0000027A311F0000-memory.dmp

Filesize
64KB

Download
memory/936-30-0x0000027A311F0000-0x0000027A31200000-memory.dmp

Filesize
64KB

Download
memory/936-31-0x0000027A30EF0000-0x0000027A30EF1000-memory.dmp

Filesize
4KB

Download
memory/936-34-0x0000027A31200000-0x0000027A31210000-memory.dmp

Filesize
64KB

Download
memory/936-104-0x0000027A31260000-0x0000027A31270000-memory.dmp

Filesize
64KB

Download
memory/936-61-0x0000027A31180000-0x0000027A31190000-memory.dmp

Filesize
64KB

Download
memory/936-64-0x0000027A31190000-0x0000027A311A0000-memory.dmp

Filesize
64KB

Download
memory/936-55-0x0000027A31210000-0x0000027A31220000-memory.dmp

Filesize
64KB

Download
memory/936-58-0x0000027A30F10000-0x0000027A31180000-memory.dmp

Filesize
2.4MB

Download
memory/936-59-0x0000027A31220000-0x0000027A31230000-memory.dmp

Filesize
64KB

Download
memory/936-62-0x0000027A31230000-0x0000027A31240000-memory.dmp

Filesize
64KB

Download
memory/936-103-0x0000027A31250000-0x0000027A31260000-memory.dmp

Filesize
64KB

Download
memory/936-16-0x0000027A31180000-0x0000027A31190000-memory.dmp

Filesize
64KB

Download
memory/936-102-0x0000027A31240000-0x0000027A31250000-memory.dmp

Filesize
64KB

Download
memory/936-69-0x0000027A31250000-0x0000027A31260000-memory.dmp

Filesize
64KB

Download
memory/936-68-0x0000027A311B0000-0x0000027A311C0000-memory.dmp

Filesize
64KB

Download
memory/936-67-0x0000027A311A0000-0x0000027A311B0000-memory.dmp

Filesize
64KB

Download
memory/936-73-0x0000027A31260000-0x0000027A31270000-memory.dmp

Filesize
64KB

Download
memory/936-72-0x0000027A311C0000-0x0000027A311D0000-memory.dmp

Filesize
64KB

Download
memory/936-77-0x0000027A30EF0000-0x0000027A30EF1000-memory.dmp

Filesize
4KB

Download
memory/936-90-0x0000027A30EF0000-0x0000027A30EF1000-memory.dmp

Filesize
4KB

Download
memory/936-93-0x0000027A30EF0000-0x0000027A30EF1000-memory.dmp

Filesize
4KB

Download
memory/936-95-0x0000027A311D0000-0x0000027A311E0000-memory.dmp

Filesize
64KB

Download
memory/936-96-0x0000027A311E0000-0x0000027A311F0000-memory.dmp

Filesize
64KB

Download
memory/936-97-0x0000027A311F0000-0x0000027A31200000-memory.dmp

Filesize
64KB

Download
memory/936-98-0x0000027A31200000-0x0000027A31210000-memory.dmp

Filesize
64KB

Download
memory/936-2-0x0000027A30F10000-0x0000027A31180000-memory.dmp

Filesize
2.4MB

Download
memory/936-100-0x0000027A31220000-0x0000027A31230000-memory.dmp

Filesize
64KB

Download
memory/936-101-0x0000027A31230000-0x0000027A31240000-memory.dmp

Filesize
64KB

Download
memory/4544-51-0x000001BEC2DA0000-0x000001BEC3010000-memory.dmp

Filesize
2.4MB

Download
memory/4544-50-0x000001BEC14E0000-0x000001BEC14E1000-memory.dmp

Filesize
4KB

Download
memory/4544-40-0x000001BEC2DA0000-0x000001BEC3010000-memory.dmp

Filesize
2.4MB

Download