94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
75s
max time network
82s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

config.te.jar
Size

32KB
MD5

636c66ab08e90059d6444a23b1288dc8
SHA1

1f3642fe9fa4ece84c45cf4ff411648fc227ff15
SHA256

b415560e6018f1719a7d2e14a2e8ca726089dac5cee0bd9763949c99fa56b6ed
SHA512

7c82c0b794cf973dda043a7f5aa73c824d7d798b78b0de28a86443eef3acaa456decf91884011608f5a2355a8b6a1216d58a4aacb6da9727eeadbfe8714df9c7
SSDEEP

768:RvWw585crFshdhJ1e1TQ3VV04+M4x5gAd:F3rFshdhiqV04+M4x+Ad

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4520	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4520	1296	java.exe	75
PID 1296 wrote to memory of 4520	1296	java.exe	75

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.te.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
b1ecbd28acf241a376e97230f408d58b

SHA1
c3daf77420b94e4179a705e3e2bf819940c9726c

SHA256
794af68fc9f4429801472c71d5de4161f8c336be964f5f0262570c555285578e

SHA512
6996742a247475271b6b622025add9459548a1fb8ea64872c7a76969b49fb22417b2fc11e0343f9c2ae8557912b27848bcb83abb2960faa7ab40d26f090ffb97

Download Submit
memory/1296-2-0x000002671DB50000-0x000002671DDC0000-memory.dmp

Filesize
2.4MB

Download
memory/1296-12-0x000002671C290000-0x000002671C291000-memory.dmp

Filesize
4KB

Download
memory/1296-13-0x000002671DB50000-0x000002671DDC0000-memory.dmp

Filesize
2.4MB

Download