94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
140s
max time network
150s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.hi.jar
Size

32KB
MD5

8e703742629cdb7ce2f3ed729d21e8ab
SHA1

867429bca1b0a72f9096fc47c6f48410c3a0a001
SHA256

d34e105197977b158bef42395a8f927704079dff13eb5b93f0758378f0811263
SHA512

4a0a1a6782f6e01a73370997781476e82367860ff3553bc006f092fe69d8d4ffcba6cd96d4d84fe5a851defd5fbd1ba7d2df7298ef6830fa63f3f3146fbcee55
SSDEEP

768:mU1jlSECy4S2rrFshdhJ1e1Tg8Zp4nO4X4sZKaQ:majlSECy4S2rrFshdhiy8Zp4nO4X4yKZ

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3136	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 3136	768	java.exe	74
PID 768 wrote to memory of 3136	768	java.exe	74

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.hi.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:768
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:3136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
342797508112fbe24a2d754eef32fca9

SHA1
0b4c3dc53eabffe2ac8e333784e0aaaaeb9e491d

SHA256
2aacf6663c56ff99f70a0f60981bc4f9e087afd17c3f648a57bac32926c77535

SHA512
5f1a8aa17149cb6d28351252108e9a3c020b2d799b564d2138a2d347f0e2310c78667df6a7a184722cefd7a0f30610a2565b12940453596bd7d1561d1fb5bdb9

Download Submit
memory/768-2-0x0000022A4FE20000-0x0000022A50090000-memory.dmp

Filesize
2.4MB

Download
memory/768-12-0x0000022A4E540000-0x0000022A4E541000-memory.dmp

Filesize
4KB

Download
memory/768-13-0x0000022A4FE20000-0x0000022A50090000-memory.dmp

Filesize
2.4MB

Download