94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
129s
max time network
141s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.en.jar
Size

40KB
MD5

e488cd6f09aff59d092737260f497e3e
SHA1

ecef9d190547709b6cb26c26a96954808abdf16f
SHA256

a96d065e970b386dc4e6f351085b62a3e79cb9f48088829dc690985e180c457d
SHA512

94adda6a2f3a7539a07b59b6a0250a7286af688cbf60c058c47f683e30625b033b6157aceaeb6389e2058420c5d27db838447cfff631efd27cbb0d7a332202ef
SSDEEP

768:81txJsrFshdhJ1e1T2QvJmZ4kKJZ4S8Lp:QrJsrFshdhihRmZ4kKJZ4S8Lp

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2088	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2088	208	java.exe	76
PID 208 wrote to memory of 2088	208	java.exe	76

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.en.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
c22d044a3a4ec93e6f1f265871e3947e

SHA1
eb8b9320d0f91cbe5c932cf6b9ec051f7aa28b8b

SHA256
63f7598f612ec2b5035ebcaf09dcc1fd081945020fa2effd10dabd3d047b027e

SHA512
4d81144d887c245ecf1ac86739aa401254d89df6f5cc24f47da2b91016980edeb7952121c5023e7d140538599de8fcdf1beca9bf76b1a1be4ee7b1dc2f291d1a

Download Submit
memory/208-2-0x0000015D08310000-0x0000015D08580000-memory.dmp

Filesize
2.4MB

Download
memory/208-12-0x0000015D06B30000-0x0000015D06B31000-memory.dmp

Filesize
4KB

Download
memory/208-13-0x0000015D08310000-0x0000015D08580000-memory.dmp

Filesize
2.4MB

Download