94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
126s
max time network
148s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.bn.jar
Size

32KB
MD5

936ab40aaefdfcb32a13056777218c70
SHA1

78ef2cf9d2d435a4141fc94d9f61d630d193c83e
SHA256

304c9e428d8638b78fdad6240790c94af8012f6cbe4f4362be7e855f3f82b6e1
SHA512

876380cf3916942a70574d1508c23525d646cf51fe4a773338afbc6582f2ec9b52bb94469e9a219b7c937500ca1274f2bfeb24ae9b8cce6dbd33ab45d6265124
SSDEEP

768:P/ruj6eNQgmrFshdhJ1e1Tu4rCoB4C8J4WPFQq:P/ruj6zrFshdhibrCoB4XJ4WNQq

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4956	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4956	1568	java.exe	74
PID 1568 wrote to memory of 4956	1568	java.exe	74

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.bn.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ae80182e90cfa8433466ab2903da0a58

SHA1
968430b5eadf32b82eb56ea2b0baa6c864fb333b

SHA256
367a46246d85864a6451e014cdd6983e33ea1445c32c0cc11303442e0d6e1120

SHA512
0c3fc013f9856aee4fa6ac5bba8b21e15a7c5657c761dd3d047a208b999eab9483dee0ae4840e785a1cd33eb77f8f994e7dfc8895bf415717e7f7bf9b21fdcae

Download Submit
memory/1568-2-0x000001C0EA030000-0x000001C0EA2A0000-memory.dmp

Filesize
2.4MB

Download
memory/1568-12-0x000001C0E8770000-0x000001C0E8771000-memory.dmp

Filesize
4KB

Download
memory/1568-13-0x000001C0EA030000-0x000001C0EA2A0000-memory.dmp

Filesize
2.4MB

Download