94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
126s
max time network
145s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.gu.jar
Size

32KB
MD5

bff9a74cb51c17c114f7c253891af4df
SHA1

136a926c71e61abb550431e4fe4707e13de97f87
SHA256

1cb8c94bfcca1a5e906043fc91a528f1d9418d3789a9f08da880f97ea9c253e0
SHA512

022ebcda993168e08f10e337bb67846016ed54a06de8d9e492313229aab77583ebecd670032f44497478ead6d8766ef7a1d4a3d0ace973a7eabab93eb00c6518
SSDEEP

768:PHilS/GhJlYrFshdhJ1e1T/Jm2i4cM4UOq7m7G:PHilS/GburFshdhiVm4cM4UOiOG

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
936	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 936	2944	java.exe	74
PID 2944 wrote to memory of 936	2944	java.exe	74

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.gu.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
d077a8b6168c242ac3b0ae3fe45aa4ca

SHA1
13a504fe3b18f155f8c7d70a6266dd0cc3cf29db

SHA256
455980deb46e7d384209324de932c4e02290912c3e2556dee6b9141ea044f77f

SHA512
b98baa7b1fb320924f1cd618daa409c35411295b53ea048b06d4e18e6ff9b3f90c0e441569642c5c2abd42fc804b251fd67e96a7533c9aaba7b1850eb04fe663

Download Submit
memory/2944-2-0x0000016081D40000-0x0000016081FB0000-memory.dmp

Filesize
2.4MB

Download
memory/2944-12-0x0000016080460000-0x0000016080461000-memory.dmp

Filesize
4KB

Download
memory/2944-13-0x0000016081D40000-0x0000016081FB0000-memory.dmp

Filesize
2.4MB

Download