94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
22s
max time network
17s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.ta.jar
Size

32KB
MD5

213bfaaffc4cbefdbb866ca3890eef0f
SHA1

8b688fa7cf9d7785653cb72f37372376684ab246
SHA256

71b82b101a10393c403bce88703d276f42a685bb255f64589166bfeb6c00b9c4
SHA512

37633f93dc3b18c050b555cc1161db7149a3f14d700f1c36c60e08c99bfbae9e3ef7f8d9fb264b86b0d33736914c1327c3a07c1ac3a8feea86cc819da87d4f5f
SSDEEP

384:YP5OIgzCeQoEBrFshdhJ1e1T7w55SjE1H9yOby81ii1381iiMgC1OVW:YP72ko6rFshdhJ1e1TdK4ia4bgCR

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1808	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1808	4788	java.exe	76
PID 4788 wrote to memory of 1808	4788	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.ta.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:1808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d8ce6d06d4f32122f5a7a509f84b6d01

SHA1
ec3f5efd8b10f94e0aa0900ef2aa942e27b004cb

SHA256
be6335d8d9d11e898a53f08718e1efd6feff07b54e39357c29369bceca4bd45e

SHA512
447709f9e941ed6bbbec133cde19656b16eae046556e3090bfbe7ef7b65235c27391f1be5ee6a2d2c3f06ab8b61d7ec5ac7d62002b82f5f943db7838dd7d3e7c

Download Submit
memory/4788-2-0x0000019C95810000-0x0000019C95A80000-memory.dmp

Filesize
2.4MB

Download
memory/4788-12-0x0000019C94040000-0x0000019C94041000-memory.dmp

Filesize
4KB

Download
memory/4788-13-0x0000019C95810000-0x0000019C95A80000-memory.dmp

Filesize
2.4MB

Download