cdc19a726fc105afcb88d124aa015b67a05341c4e9e8bca9d2deee3f5d80c9cc

Analysis

max time kernel
191s
max time network
302s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/08/2024, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/lib/javaws.jar
Size

465KB
MD5

5d8c1723f3005bd63dba2b478ce15621
SHA1

ab26a6167789dcf81a0c40d121dc91005804c703
SHA256

b637b78cfc33c92d4838d5fabfd0647ce03c3ef69d86ef6a7e6f229510aaf3b5
SHA512

9830ccdfe913a492bb4e0015ee3e729bea8ec1f22edf48ed7ce2aefd5376df24f33948b9155e31edfa9bc240544406fd2c43a34dd1366e4936b3318d3ca5ed1c
SSDEEP

12288:k4VtaECp5plmgYhuWvHuR9Ta/+Aw7okxygk+W:kUChlHYHMaHw7XxW

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
936	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 936	1636	java.exe	74
PID 1636 wrote to memory of 936	1636	java.exe	74

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\jre\lib\javaws.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
f22faaa05745c17edd57b4d91d82e3ea

SHA1
804b7d62a7d3ec40ae637958c00a3026e16b7ccd

SHA256
fb98e3ea7ec237423bfd4d61ea5810610e500d80eea15b7b57ea3c7cbd1bbdb6

SHA512
a5c68390318be62645a37fe284c6e9516835fe97204d2538957b742af7a3554da5feea1490918b74b85586d64c7f8de87abae6c160ed5b03d492887badef298e

Download Submit
memory/1636-2-0x000002E0DF190000-0x000002E0DF400000-memory.dmp

Filesize
2.4MB

Download
memory/1636-12-0x000002E0DD8A0000-0x000002E0DD8A1000-memory.dmp

Filesize
4KB

Download
memory/1636-13-0x000002E0DF190000-0x000002E0DF400000-memory.dmp

Filesize
2.4MB

Download