94034255f021a3f7965cc56590d2b2581674a590d3c40c9de9ee86433bcdd8f1

Analysis

max time kernel
124s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-09-2024 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

config.mdpi.jar
Size

49KB
MD5

d953eda815b10b032c7c9eaccbfee762
SHA1

6b98e92df8009a43da5a416e777f24f5168c721d
SHA256

7deaff137267793bb74165c16234599878db54efa487c4ccb3cef1311ee3a8f3
SHA512

4e33a022d38c80435e48998ae176cadd2fd311fb9841a5c6ad076f385c3c89b6ddd9db2384f4d384eb87b7a2968a974a679002fa62969102df28b441e8365e99
SSDEEP

768:6kW+V553YWwL3gDtsB+7u3zo4ffDUpBDK24KYs49Qq0qAx:6kW2tYWwL3gJsBJDo2DUz94rs49G

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4272	icacls.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 4272	908	java.exe	73
PID 908 wrote to memory of 4272	908	java.exe	73

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\config.mdpi.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\icacls.exe
  C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
  2⤵
  - Modifies file permissions
  PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
ee29a4c9cee509bc24c78556e8911de0

SHA1
8c80e6b9f7c3300a7d2c016ee7e509cb9218e37e

SHA256
5f093550b99f97e6e2d7376138c8ecf0d9ebf8e466bb624e41a070b5bcf03904

SHA512
8eb2551999d72226b6b7b2c8a368cd654346bc38c90785efd6b49ad48e77551f346d330da8261c02b3079dae44a14bdcdccd9c5de2203da0c02c5b513e5b41d1

Download Submit
memory/908-2-0x000001F280000000-0x000001F280270000-memory.dmp

Filesize
2.4MB

Download
memory/908-12-0x000001F2F11A0000-0x000001F2F11A1000-memory.dmp

Filesize
4KB

Download
memory/908-13-0x000001F280000000-0x000001F280270000-memory.dmp

Filesize
2.4MB

Download